Dependency Confusion Dependency confusion is an attack on the process by which software build platforms find and deliver software dependencies. An attacker can publish a package on a public registry with the same name as an organization's internal package, or with the name of another public and valid package, counting on the fetching tool choosing their version over the real one.

Typosquatting A package in the PyPI or npm registry has a name similar to a popular library but runs malicious code on installation.