Tag
dependency-confusion
- Dec 7, 2024 Dependency Confusion and the Order Registries Are Consulted When a build resolves a private package name against a public registry, an attacker can claim the name first. The mechanism is registry precedence, not a bug. security
- Jun 18, 2024 How a Package Name Becomes a Download: Registry Lookup Order and Confusion The chain from a bare name in a manifest to a fetched artifact, how registries and scoped namespaces are consulted in order, and why that order is exploitable. software engineering