Glossary
Dependency Confusion
A supply chain attack technique in which an attacker publishes a malicious package to a public package repository using the same name as an internal, private package, tricking a build system into pulling the attacker's version if it is misconfigured to prefer public sources. It was publicly demonstrated in 2021 against several major tech companies.