NPM Dependency Confusion Attack

Detects package.json configurations vulnerable to dependency confusion attacks where internal package names could be hijacked via public npm registry.

zakirkun Updated

File contents

NPM Dependency Confusion Attack

Overview

Dependency confusion exploits package manager precedence: if an internal package is published to the public npm registry with a higher version, it gets installed instead of the internal one. Attackers scan job postings and error messages for internal package names.

Remediation

  • Use scoped packages: @company/internal-package (scoped packages can only conflict in the same scope)
  • Configure npmrc to always use internal registry for internal packages
  • Use package-lock.json integrity checks
  • Add publishConfig to prevent accidental public publishing

zakirkun/ice-tea/tree/main/skills/supply-chain/npm-dependency-confusion commit c2b24a9d2e

Frequently asked questions

npx skillmds@latest add zakirkun/npm-dependency-confusion-attack