Description

A Dependency Confusion attack occurs when a software installer script is tricked into pulling a malicious package from a public repository instead of the intended file of the same name from an internal repository. It was found that the package was found missing from NPM Public Registry. A bad actor can abuse such scenario to create a malicious NPM package and register it in the public NPM Registry with the same name.

• 

  Recommended Mitigation

  To remediate a potential NPM Dependency Confusion, follow these steps. First, conduct an audit using tools like npm audit or vulnerability scanners to identify vulnerable packages. Next, pin dependencies to specific versions in your project's configuration files (e.g., package.json, yarn.lock) to ensure exact versions are installed. Verify package sources by configuring the `.npmrc` file to use trusted registries, avoiding untrusted or unknown sources. Remove or replace suspicious or unauthorized packages found during the audit, using tools like npm ls to check for conflicting sources. Finally, keep dependencies up to date by regularly reviewing and updating them using package manager commands (npm update, yarn upgrade), ensuring you have the latest versions and security patches.