https://nalar.dev/tags/package-security/ Recent content in Package Security on Nalar Hugo en-us Sat, 05 Sep 2026 00:00:00 +0700 https://nalar.dev/prevent-dependency-confusion-with-explicit-package-sources/ Sat, 05 Sep 2026 00:00:00 +0700 https://nalar.dev/prevent-dependency-confusion-with-explicit-package-sources/ <p>A dependency declaration can look precise and still leave an important security question unanswered: <strong>where is this package allowed to come from?</strong></p> <p>This matters when an organisation uses both private packages and a public package registry. If a package manager or build configuration can resolve the same package name from more than one source, an attacker may be able to publish a public package that competes with the intended private one. A build that selects the wrong source can then run attacker-controlled package code inside a trusted development or build environment.</p>