dependency confusion attack helped security researcher Alex Birsan earn $130,000 in bug bounties after demonstrating that build systems at Apple, Microsoft, PayPal, Uber, Yelp, Tesla, and 30+ other companies could be tricked into running code from public package registries.
The attack did not exploit a single CVE. It exploited a package manager assumption: when public and private registries contain packages with the same name, the build system may choose the public package, especially when the public version number is higher.
Warning: Traditional CVE scanning alone does not stop dependency confusion because the malicious package can be brand new and have no vulnerability record.
The $130,000 Bug Bounty That Changed Supply Chain Security
Dependency confusion became widely known in February 2021 when Alex Birsan showed that major companies could accidentally install attacker-controlled packages during normal builds. He did not need a zero-day exploit, leaked credentials, or malware hidden inside a popular package. He needed internal package names.
