Dependency confusion: impersonating the internal package

Companies use internal packages (company-utils) from a private registry. Dependency confusion exploits how package managers choose where to fetch them.

The mechanism

If an internal name is not also registered on the public registry, the attacker publishes it there with a higher version. Many clients, searching both registries, pick the highest version — the malicious public one — and run its install code in the build (often in CI, with access to secrets).

// internal package.json: "company-utils": "^1.0.0"
// attacker publishes [email protected] on public npm
// npm install takes 99.0.0 -> preinstall script -> RCE in CI

It worked against major companies as a proof of concept (Alex Birsan, 2021).

Defence

Reserve internal names on public registries too (namespaces/scopes: @company/utils). Configure the client to fetch those scopes only from the private registry (scoped registry). Integrity/lockfile verification, and block untrusted install scripts in CI. Never let the public registry win over the private one.