Package Security

Prevent Dependency Confusion with Explicit Package Sources

A dependency declaration can look precise and still leave an important security question unanswered: where is this package allowed to come from? This matters when an organisation uses both private packages and a public package registry. If a package manager or build configuration can resolve the same package name from more than one source, an attacker may be able to publish a public package that competes with the intended private one. A build that selects the wrong source can then run attacker-controlled package code inside a trusted development or build environment.