Glossary

Dependency Confusion

A supply chain attack technique in which an attacker publishes a malicious package to a public package repository using the same name as an internal, private package, tricking a build system into pulling the attacker's version if it is misconfigured to prefer public sources. It was publicly demonstrated in 2021 against several major tech companies.

Recent coverage mentioning Dependency Confusion

SU

HIGH

Supply Chain

Critical npm Supply Chain Attack Delivers Cross-Platform RAT/Infostealer

Critical npm supply chain attack involving nearly 800 malicious packages delivers WEL1DROPPER RAT and infostealer to Windows, macOS, and Linux users.

Runtime Rebel Intel

5 min read · Aug 8, 2026

SU

HIGH

Supply Chain

Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Users

Discover how 18 malicious npm packages target Alibaba developer tools with a cross-platform remote access trojan in a supply chain attack.

Runtime Rebel Intel

3 min read · Aug 4, 2026

← All 285 glossary terms