Profile My skills Saved Collections Edit profile Submit a skill

NPM Dependency Confusion Attack

Detects package.json configurations vulnerable to dependency confusion attacks where internal package names could be hijacked via public npm registry.

zakirkun c2b24a9 2 files · 2.5 KB Updated
Coding & Dev Tools

File contents

NPM Dependency Confusion Attack

Overview

Dependency confusion exploits package manager precedence: if an internal package is published to the public npm registry with a higher version, it gets installed instead of the internal one. Attackers scan job postings and error messages for internal package names.

Remediation

  • Use scoped packages: @company/internal-package (scoped packages can only conflict in the same scope)
  • Configure npmrc to always use internal registry for internal packages
  • Use package-lock.json integrity checks
  • Add publishConfig to prevent accidental public publishing

zakirkun/ice-tea/tree/main/skills/supply-chain/npm-dependency-confusion commit c2b24a9d2e

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/npm-dependency-confusion-attack