Security News > 2021 > February > Dependency Confusion: Another Supply-Chain Vulnerability
Today, developers at small or large companies use package managers to download and import libraries that are then assembled together using build tools to create a final app.
For these apps, companies will often use private libraries that they store inside a private package repository, hosted inside the company's own network.
When apps are built, the company's developers will mix these private libraries with public libraries downloaded from public package portals like npm, PyPI, NuGet, or others.
Researchers showed that if an attacker learns the names of private libraries used inside a company's app-building process, they could register these names on public package repositories and upload public libraries that contain malicious code.
The "Dependency confusion" attack takes place when developers build their apps inside enterprise environments, and their package manager prioritizes the library hosted on the public repository instead of the internal library with the same name.
The research team said they put this discovery to the test by searching for situations where big tech firms accidentally leaked the names of various internal libraries and then registered those same libraries on package repositories like npm, RubyGems, and PyPI. Using this method, researchers said they successfully loaded their code inside apps used by 35 major tech firms, including the likes of Apple, Microsoft, PayPal, Shopify, Netflix, Yelp, Uber, and others.