Dependency confusion and unintended package origin
Dependency resolution selects an attacker-controlled package origin where the build or application expects an organization-controlled package.
Candidate CWE: CWE-829
Test hypothesis#
Inspect resolver configuration, namespace ownership, lock/integrity handling, and fallback rules. Reproduce with two local registries and synthetic package names using the relevant package-manager version. Record origin selection and whether install/build/runtime code would consume it; do not register real missing package names.
Evidence required#
Exact dependency and resolver configuration, package-manager version, local registry logs, selected package origin/version/hash, and affected consumer/build context. Separate resolver behavior from unconfirmed public namespace control.
Rule out false positives#
Private index mapping, exclusive source constraints, verified hashes, or immutable resolution prevents the alternate package from being selected. A public package of the same name existing is not enough.
Playbook and command references#
- Dependencies: from advisory match to reachable impact — Separate composition, advisory matching, runtime reachability, and exploit prerequisites so dependency reports describe product impact.
- CI and releases: trace untrusted input into privileged work — Audit workflow events, shell interpolation, untrusted builds, artifact consumers, and release identity as one privilege chain.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
- T1195.001 · Supply Chain Compromise: Compromise Software Dependencies and Development Tools — Only if: A controlled reproduction shows maliciously modified dependency or development-tool content being consumed through a software supply chain, such as a substituted reusable build action. Not established by: An old vulnerable dependency, an SBOM finding, or arbitrary CI log access does not prove supply-chain compromise. Show the manipulated component and consumer path.