Dependency Confusion

A supply chain attack that exploits package name resolution to substitute an internal dependency with a malicious package published on a public registry. Dependency confusion hit Apple, Microsoft, and PayPal in 2021 via npm, PyPI, and RubyGems. Protection involves package scoping, private registries, and source verification.