Intermediate LevelWeb Security & Cyber Defense
What is a Dependency Confusion Attack and how do you protect internal private npm/Python packages?
❓ Interview Prompt: Explain Dependency Confusion, publishing public npm/PyPI packages with private names, package manager resolution order, and scoped packages (`@company/pkg`).
Dependency Confusion tricks package managers into downloading a malicious public package instead of an internal private package:
Attack Mechanics:
An attacker discovers internal package names ('corp-auth-utils'). The attacker publishes a public package named 'corp-auth-utils' on 'npmjs.com' with a higher version number ('99.0.0').
•
When internal build servers run 'npm install', the package manager fetches the higher public version from npmjs.com!
•
Defense: Use explicit npm scopes ('@mycompany/auth-utils') or configure internal '.npmrc' registries to restrict scoped packages exclusively to internal Artifactory/Nexus servers.
Code Implementation Example
ini
; .npmrc - Restrict @mycompany scoped packages to internal registry ONLY!
@mycompany:registry=https://nexus.internal.company.com/repository/npm-private/
always-auth=true💡Configuring .npmrc to route scoped private packages to internal registries.
🎯 Interview Key Takeaway
Use scoped package names (@company/pkg) and configure .npmrc registry rules to prevent Dependency Confusion attacks.
#Dependency Confusion#Supply Chain#npm#Intermediate
Back to all Web Security & Cyber Defense Questions→