Dependency Confusion: An Overview
Dependency Confusion, also known as "Substitution Attack" or "Name-Squatting Attack", is a
software supply chain vulnerability
that targets package managers (like npm, PyPI, RubyGems, etc.) by exploiting the way they resolve
dependencies in software projects.
How Dependency Confusion Works
The core of dependency confusion lies in the distinction between internal (private) and public
package registries:
1. Private Packages: Large organizations often maintain private/internal package repositories to
distribute proprietary software libraries.
2. Public Packages: Open-source packages that are distributed on public registries like npm, PyPI,
or RubyGems.
Attack Vector:
If a project uses both private and public package repositories, a malicious actor can upload a public
package to a public registry
that mimics the name of a private package.
Package Managers' Default Behavior: Many package managers prioritize public packages over
internal/private ones when fetching dependencies,
especially if the private package name is not locked down.
By uploading a package with the same name as an internal one to a public registry, the attacker can
trick the dependency resolver into pulling
the malicious public package instead of the legitimate private one. This allows the attacker to
execute arbitrary code or exfiltrate sensitive data.
Key Discovery: 2021 - Alex Birsan's Report
In early 2021, Alex Birsan, a security researcher, publicly demonstrated how this attack could be
used to infiltrate major companies by exploiting
dependency confusion in their software builds.
He successfully injected malicious code into the internal systems of well-known companies like
Microsoft, Apple, PayPal, and Tesla by publishing
packages with the same names as their internal dependencies to public repositories.
Evolution of Dependency Confusion
1. Initial Discovery (2021)
- First widespread proof-of-concept led to increased awareness of this vulnerability.
- Bug bounties and major companies were affected.
2. Response from Ecosystems and Vendors
- Package Manager Changes: Improvements in package resolution, warning messages, and
reserved namespaces.
- Private Registry Hardening: Companies started to enforce stronger security policies.
3. Increased Attention to Supply Chain Security
- Supply Chain Attacks Rise: Dependency confusion became a major part of supply chain security
concerns.
- SaaS Solutions and Tools emerged for detecting typosquatting and conducting dependency
audits.
4. Advanced Variations and Ongoing Challenges (2022-2024)
- Advanced Exploits: Attackers started combining dependency confusion with typosquatting and
hijacking abandoned packages.
- Focus on CI/CD Pipelines: Organizations worked to secure their build pipelines and prevent
malicious packages from being pulled.
- Enhanced Monitoring: Security teams began to focus on monitoring package sources for unusual
behavior.
Key Mitigations for Dependency Confusion:
1. Private Registry Prioritization: Ensure that private repositories are prioritized over public ones.
2. Namespace Lockdown: Lock down or preemptively register important package names in public
registries.
3. Dependency Whitelisting/Blacklisting: Implement strict rules on which sources packages can be
downloaded from.
4. Version Pinning: Pin exact versions of dependencies to prevent unintended upgrades or
substitutions.
5. Regular Dependency Audits: Regularly audit dependencies and their sources to ensure they are
legitimate.
Conclusion:
Dependency confusion has evolved from a novel discovery to a widespread attack vector. While
companies have responded by hardening their systems
and processes, attackers continue to explore advanced variations of this attack. It remains a crucial
concern for software supply chain security.
