Comparison
Dependency confusionvsSoftware supply chain
Dependency confusion
an attacker published a package with your internal name at a higher version, and the build helpfully preferred it.
Exploiting a build tool that consults both a public registry and an internal one, by publishing a public package matching an internal name. The build picks the higher version, which is the public one, and executes the attacker's install script inside your pipeline. The fixes are structural: reserve your namespaces publicly, scope internal packages, and configure the client so internal names are never resolved externally.
Full entry →Software supply chain
your artefact contains code from four hundred projects you have never read and a build system nobody has audited.
Everything that contributes to a released artefact: dependencies, base images, build tools, the pipeline itself and the people with access to any of them. Attacks target it because compromising one widely-used link reaches everyone downstream, and because it is much less defended than production. The defences are dull and effective — pin versions, verify what you pull, build hermetically, sign what you publish, and know what is inside.
Full entry →