SC-DEPENDENCY-CONFUSION-BIRSAN-2021
Summary
In February 2021 researcher Alex Birsan published the dependency confusion technique, exploiting how package managers (npm, PyPI, RubyGems) resolve a public package over a private one of the same name with a higher version. By publishing packages matching leaked internal package names to public registries, he achieved code execution on internal build systems at more than 35 companies including Apple, Microsoft, PayPal, Shopify, Netflix, Tesla and Uber. The research was authorized and earned over $130,000 in bug bounties, reshaping enterprise understanding of supply-chain namespace risk.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-62847
Metalama allows local code execution through DLL planting in shared temporary directories
- HIGHCVE-2026-61446
PraisonAI: Plugin Auto-Discovery Executes Arbitrary Python Files Without Verification
- HIGHCVE-2026-86540
knowns OS Command Injection via Insecure LSP Binary Path Config in .knowns/config.json
- HIGHCVE-2026-87817
GitPython: Repository content can impersonate the git directory, leading to arbitrary code execution
- HIGHCVE-2026-78680
NLTK: Uncontrolled search path when invoking the Graphviz 'dot' binary
- HIGHPYPI-TORCHTRITON-2022
Between December 25 and December 30, 2022, a dependency confusion attack hit PyTorch-nightly. An attacker uploaded a malicious package named 'torchtriton' to the public PyPI index with a higher version than the legitimate one shipped on PyTorch's own index; because pip prioritized PyPI, the malicious package was installed by default. The payload collected system fingerprint data (IP, hostname, username, working directory), read sensitive files such as /etc/passwd and SSH keys, and exfiltrated them. PyTorch renamed the dependency to 'pytorch-triton' and reserved a dummy PyPI package to prevent recurrence.