Dependency confusion: a package name is an attack

Earlier this month a security researcher showed a simple trick. Companies use internal packages with private names. If someone publishes a public package with the same name and a higher version number on npm, PyPI or RubyGems, some build tools install the public one instead. The researcher’s test packages ran inside dozens of big companies, including Apple, Microsoft and PayPal, and collected bug bounties.

Check your setup:

• Use scoped or namespaced packages (like @yourcompany/utils) and own that scope on the public registry.
• Point package managers at one registry that proxies the public one, so internal names always win.
• Pin versions and use lock files.
• Reserve your internal names on public registries with empty placeholder packages, if scopes aren’t possible.
• Watch build servers for unexpected outbound connections.

Package managers do exactly what they’re told. Make sure you’re telling them the right thing.