What is dependency confusion?
Updated
Dependency confusion is publishing a public package with the same name as a company's private one, so that a build that checks the public registry installs the attacker's version instead.
Quotable facts
As of 2026-10-07
- Private package names are not reserved on public registries (definition, 2026-10-07).
- A scope, such as @yourcompany/, marks a package name as belonging to one owner (npm naming, 2026-10-07).
- Crowsnest reads your lockfile, which records the version of every package that was installed (lockfile reader, 2026-10-07).
Why does it matter?
Private names are not reserved on public registries. A build that looks in both places can pick the wrong one without anyone noticing.
How do I stay safe?
- Tell your tools to fetch private packages only from your private registry.
- Use a scope (such as
@yourcompany/) for private package names. - Check where a package was installed from when a build uses an unexpected version.
What this does not do
This page defines the term. Crowsnest does not read your registry settings, so it cannot tell you whether your build is set up to prefer the private registry.
Where do I read more?
Related terms: typosquatting and lockfile. Read How to stay safe from malicious packages, or see the FAQ. Back to the glossary.
Related
- TyposquattingTyposquatting is publishing a package whose name is almost the same as a popular one, such as a missing letter or a moved hyphen, hoping someone mistypes an install command.
- LockfileA lockfile is a file, such as package-lock.json, that records the exact version of every package your project installed, including the packages your packages depend on.
- How to stay safe from malicious packages.Five habits that take under a minute each.
- FAQAnswers to common questions about Crowsnest: what it is, whether it needs API keys, what it costs, what it can't see and what to do when it says Hold.