Dependency Confusion
A software supply chain attack where malicious packages with the same name as internal dependencies are published to public repositories, tricking build systems into using the malicious version.
Related Terms
Package Manager
A tool that automates the process of installing, upgrading, configuring, and removing software dependencies in a consistent manner.
Supply Chain Attack
A cyberattack that targets the less-secure elements in the software supply chain to compromise the intended target.
Typosquatting
A software supply chain attack where malicious packages with names similar to popular dependencies are published, exploiting common typing errors to trick developers into installing them.