Dependency Confusion Attacks: How to Find Supply Chain Bugs
Dependency confusion (also called substitution attacks) happens when a build system prefers a public package over a private one with the same name. An attacker publishes a higher-version package to npm, PyPI, or similar — and the CI pipeline installs the public copy instead of the internal library.
This is a supply-chain bug with outsized impact: one package can reach every build that trusts the name.
Where to look
- JavaScript
package.json/ lockfiles referencing scoped or unscoped internal names - Python
requirements.txt/ Poetry / Pipenv with private indexes - Ruby gems, NuGet, Go modules with mixed public/private sources
- Docker and CI configs that set multiple registries without pinning
Hunt for names that look internal (@acme/payments, acme-internal-utils) and check whether the same name is claimable on the public registry.
Safe proof workflow
- Identify candidate package names from public JS, mobile apps, job postings, or error pages — never from unauthorized private repos.
- Check the public registry: does the name exist? Who owns it? What versions?
- If the program allows, register a benign placeholder under a name you control that matches their naming pattern only when the program’s policy explicitly permits claim tests.
- Prefer reporting “name is claimable / resolution order is unsafe” with config evidence over publishing a real substitute package.
Many programs forbid publishing packages that impersonate them. Follow the policy — a clear resolution-order finding without a live package is often enough.
What good impact looks like
- CI would install a public package for an internal import path
- No scope or integrity pin prevents substitution
- The package runs in build or runtime with network/credentials access
Report tips
Include the package name, the registries consulted, the resolution order, and a diagram of install time. Recommend scoped packages, private registry priority, lockfile integrity hashes, and reserved namespace claims.
Defensive checklist
- Use scoped packages and claim org names on public registries.
- Configure package managers to prefer the private registry and fail closed.
- Pin versions with lockfiles and verify integrity hashes.
- Monitor for new public packages matching internal names.
- Treat CI tokens as high-value secrets.
Dependency confusion rewards recon more than payloads. Map how the build resolves names — that is the bug.
Original Bugflare guide informed by public dependency confusion research methodology.