domains / families / security / detecting-dependency-confusion
detecting-dependency-confusion
separate
Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles/manifests for confusable dependencies, or after an incident that may have leaked internal package names.
When to use
- When onboarding a repository or organization to a supply-chain security program and you need to baseline which internal packages are claimable on public registries.
- When CI/CD pipelines resolve dependencies from both private and public registries (mixed/hybrid feeds).
- After any incident where internal package names may have been exposed (leaked source, public bundle, breached repo).
- When auditing `package.json`, `requirements.txt`, `pom.xml`, `composer.json`, or `Gemfile.lock` files for confusable dependencies.
- As a recurring scheduled control to detect newly added internal packages that have not yet been defensively registered.
When not to use
- registering or claiming package namespaces you do not own
- testing build pipelines without written authorization
Skill page
Source