Platform & DevOps·Secrets, identity and the supply chain
an attacker published a package with your internal name at a higher version, and the build helpfully preferred it.
Dependency confusion
Also callednamespace confusion, substitution attack
Exploiting a build tool that consults both a public registry and an internal one, by publishing a public package matching an internal name. The build picks the higher version, which is the public one, and executes the attacker's install script inside your pipeline. The fixes are structural: reserve your namespaces publicly, scope internal packages, and configure the client so internal names are never resolved externally.