Learn English vocabulary for dependency confusion attacks: namespace confusion, typosquatting, private registries, scoped packages, and defense strategies.
0 / 10 completed
1 / 10
A 'dependency confusion' attack (also called namespace confusion) works because:
Researcher Alex Birsan demonstrated in 2021 that many companies' build systems would install his public packages over internal private ones because the package manager preferred the higher version number on the public registry — successfully hitting Apple, Microsoft, and PayPal.
2 / 10
Using 'scoped packages' (e.g., @mycompany/utils) as a defense against dependency confusion works because:
By claiming the @mycompany npm scope, only verified members of that organisation can publish @mycompany/ packages. An attacker cannot publish @mycompany/utils to npm without controlling that scope — eliminating the confusion vector for that namespace.
3 / 10
'Typosquatting' in the package registry context differs from a dependency confusion attack in that:
Typosquatting requires the developer to mistype. Dependency confusion uses the exact correct internal package name but exploits the registry resolution order — the developer types the name correctly but gets the attacker's public version.
A properly configured private registry can enforce that @mycompany/ packages only resolve internally and never fall through to npm, while public packages are proxied and cached. This controlled routing eliminates the ambiguity attackers exploit.
5 / 10
To fully mitigate dependency confusion risk, security teams recommend configuring package managers to:
Pinning exact versions with lockfile integrity hashes (SHA-512) means any substituted package fails the checksum check. Combined with registry scoping and private registry routing rules, this creates defense-in-depth against confusion attacks.
6 / 10
Alice, a junior developer on the team, posted this comment to the code review for a new feature:
"I've added npm install react@1.8.0. It seems like we're using an older version of React and I thought it would be simpler."
Alice's action constitutes a dependency confusion attack. By introducing a different version of React (react@1.8.0) without proper coordination, she could potentially cause conflicts with other dependencies in the project. The core issue is that the code review should focus on the feature's logic, not simply the package versions being used.
7 / 10
Ben sent this Slack message to the team channel:
'I'm seeing weird build errors after upgrading our dependencies. It seems like some packages are being pulled in with different names – one time it's @mycompany/utils, and then suddenly it's @myorg/utils. It's driving me crazy!'
Ben's description strongly suggests a dependency confusion attack. The erratic behavior of package names – switching between different namespaces – is the hallmark symptom of this type of vulnerability. Package managers can sometimes resolve dependencies in unexpected ways when multiple packages have similar names, leading to conflicting versions being pulled in.
8 / 10
You are reviewing a pull request for a new microservice. The PR description includes this:
'We've updated the dependencies to ensure compatibility with the latest versions of all our libraries. This includes lodash@4.17.21, moment@2.29.1, and axios@0.27.2.'
The provided PR description is good practice. It clearly lists the updated dependencies and their specific versions. This allows reviewers to quickly identify potential conflicts or incompatibilities related to dependency confusion attacks, especially if those packages are being used in multiple parts of the system. Explicit versioning is key for mitigation.
9 / 10
A security team recommends configuring a private package registry like Artifactory to prevent dependency confusion attacks. What is the primary benefit of this approach?
Using a private package registry provides centralized control and visibility into dependency management. This allows security teams to enforce policies, manage versioning, and block potentially malicious packages before they're installed in development environments – directly addressing the risk of namespace confusion attacks by controlling which versions are available.
10 / 10
To minimize the risk of dependency confusion attacks, a security team advises developers to configure their package managers to:
Pinning package versions – specifying exact or constrained version ranges – is crucial for preventing dependency confusion. This ensures that only approved versions are installed and avoids the unpredictable behavior that can result from automatically updating packages with potentially conflicting namespaces. This provides a clear boundary against malicious injection.
What will I learn from the "Dependency Confusion Attack Vocabulary" exercise?
Learn English vocabulary for dependency confusion attacks: namespace confusion, typosquatting, private registries, scoped packages, and defense strategies.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account, sign-up, or paywall required.
How many questions are in this exercise?
This set contains 10 multiple-choice questions, each with a detailed explanation shown after you answer.
Do I need to create an account to track my progress?
No account is required. Your progress bar and score reset each time you reload the page, but you can retry the exercise as many times as you like.
Who is this Supply Chain Security exercise for?
This exercise is built for IT professionals and non-native English speakers who need to read, write, and discuss supply chain security topics confidently at work.
What happens if I answer a question incorrectly?
You will see the correct answer highlighted along with a detailed explanation of why it is correct -- so every wrong answer becomes a learning moment, not just a lost point.
Can I retry this exercise?
Yes -- click "Try again" on the results screen at any time to reset your score and go through all the questions again.
How long does this exercise take to complete?
Most learners finish all 10 questions in under 10 minutes, since each question is answered by clicking a single option.
Where can I find more Supply Chain Security exercises?
See the full Supply Chain Security exercises hub for more vocabulary drills on this topic.
Is this exercise mobile-friendly?
Yes -- the exercise works on any device with a modern browser, including phones and tablets, with no app download required.