Dependency Confusion
A software supply chain attack that tricks a build system into installing a malicious public package instead of an intended internal one, by exploiting naming or versioning ambiguity.
Dependency confusion is a software supply chain attack in which an attacker publishes a malicious package to a public package registry using the same name as an organization's private, internal package, often with a higher version number — exploiting many build tools' default behavior of preferring the public registry or the highest available version number, which can cause the build system to automatically pull in and execute the attacker's malicious package instead of the legitimate internal one.
This is one specific technique within the broader category of a supply chain attack (see Kaavon's "Supply Chain Attack (Crypto)" glossary definition) targeting crypto projects, since a compromised build pipeline can inject malicious code directly into a wallet, exchange, or protocol's software before it ever reaches end users — making it a particularly dangerous attack vector precisely because it compromises trusted, officially distributed software rather than requiring any mistake by the end user themselves. Defenses include using private package registries with strict scoping, pinning exact dependency versions, and auditing build pipeline configurations for naming ambiguities that could be exploited this way.
Examples
- An attacker could publish a malicious public package sharing the same name as a crypto exchange's internal package, hoping the exchange's build system mistakenly installs the malicious public version instead.
- Dependency confusion is especially dangerous because it compromises trusted, officially distributed software at the build stage, rather than relying on any mistake by the end user.