Unverified50% confidenceFactExact time
Dependency confusion is an attack in which the attacker publishes a malicious package in a public repository under the same name as a company's internal private package but with a higher version number, exploiting the default behavior of package managers to prioritize pulling from public repositories to achieve infiltration.
1
Sources
50%
Confidence
Long-term
Relevance
10/1/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedDependency poisoning attackers can upload malicious packages with the same name as private packages but with higher version numbers to public package registries, luring build systems into automatically pulling them.79% similarUnverifiedDependency confusion attacks exploit the characteristic of package managers to check public sources first when resolving dependencies, allowing attackers to register package names used internally by enterprises in order to trick build systems into downloading malicious code.78% similarUnverifiedAttackers can exfiltrate sensitive information out of the sandbox through legitimate outbound channels by embedding malicious code in dependency packages (supply chain attacks).68% similarUnverified攻击者常借助混淆技术隐藏恶意脚本诱导用户复制粘贴运行，这类手法被称为剪贴板劫持或社会工程学注入67% similarUnverified拥有文件系统写权限、网络访问权限和命令执行权限的Agent遭受提示词注入可能引发数据泄露、系统破坏或横向渗透66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/965542API
curl https://kongchang.com/api/v1/knowledge/claims/965542MCP
get_claim(id=965542)