What is dependency confusion?
Dependency confusion is a software supply-chain attack that tricks a build system into downloading an attacker's package instead of a company's own internal one. Many organizations use private packages named for internal projects, and their build tools are configured to pull dependencies from both a private registry and a public one. The attack exploits how the tool chooses between two packages that share a name.
How the attack works
The attacker learns the name of an internal package, which often leaks in public code, error messages or job postings, and publishes a package with that exact name to a public registry, giving it a very high version number. When a build runs, a tool that resolves names from both sources, and prefers the highest version it can find, reaches out to the public registry and installs the attacker's package. The malicious code then runs on developer machines and build servers, which usually hold credentials and reach into production. It is the automatic version-selection logic, not a typo, that causes the confusion.
The research that named it
A security researcher demonstrated the technique in 2021 by publishing packages to public registries under the names of internal packages used at a number of large technology companies, with inflated version numbers. Build systems at many of them preferred the public versions and ran his harmless proof-of-concept code, which showed how widely the default behavior could be abused.
How to defend against it
Control where internal names resolve from. Pull packages through an internal registry or proxy that never resolves an internal name from the public one, and claim or reserve your internal names on public registries so no one else can publish them. Use scoped or namespaced names tied to your organization, pin exact versions with a lockfile and integrity hashes so a surprise high version is not pulled, and verify package sources in the build pipeline. Software composition analysis helps spot unexpected dependencies.
Dependency confusion on the CompTIA Security+ exam
Dependency confusion falls under the public code-repository and package-registry risks in SY0-801 objective 2.4. The scenario clue is a build pulling a package from a public registry because it carried a higher version than the matching internal one, running untrusted code on build infrastructure. Separate it from typosquatting, which relies on a mistyped name, and from a compromised maintainer account. The defenses the exam rewards are scoped names, version pinning and a registry that will not resolve internal names publicly.