Build fluency in the vocabulary of preventing a malicious package from impersonating an internal one.
0 / 5 completed
1 / 5
At standup, a dev mentions an attack where a malicious public package is published under the exact same name as a company's internal private package, tricking a misconfigured build into installing the malicious public version instead. What is this attack called?
Dependency confusion is an attack where a malicious actor publishes a public package under the exact same name as a company's internal private package, tricking a misconfigured build system into installing the malicious public version instead of the intended private one. A normal, legitimate internal package update comes from the company's own trusted internal registry, not from an external public source impersonating it. This attack specifically exploits an ambiguity in how a build system decides which registry to pull a same-named package from.
2 / 5
During a design review, the team wants their build system to always resolve an internal package name from their private registry first, with no fallback to a public registry for that same name. Which capability supports this?
Registry scoping configures the build system to always resolve an internal package name from the intended private registry first, with no fallback to a public registry for that exact same name. Letting the system resolve from whichever registry responds first, public or private, is precisely the ambiguity a dependency confusion attack exploits. This explicit scoping closes that ambiguity, ensuring an internal package name can only ever resolve to the company's genuine internal source.
3 / 5
In a code review, a dev notices every internal package name is prefixed with the company's own reserved namespace, like an organization-specific scope, making an exact name collision with an unrelated public package far less likely. What does this represent?
Namespacing internal packages under the company's own reserved scope makes an exact name collision with an unrelated public package far less likely in the first place, since the reserved scope isn't something an outside attacker can typically claim. Publishing under a generic, unscoped name leaves the door open to exactly the kind of collision a dependency confusion attack depends on. This namespacing is a proactive, preventive measure that reduces the attack's viability before it ever reaches the registry-resolution stage.
4 / 5
An incident report shows a build pipeline pulled a malicious package from a public registry because an internal package of the exact same name existed only in the private registry with no explicit registry priority configured. What practice would prevent this?
Explicitly configuring the build system's registry priority or scoping ensures an internal package name can never accidentally resolve from an untrusted public registry, closing the exact gap this incident exploited. Leaving the resolution order unconfigured and dependent on whichever registry responds first is the root misconfiguration that makes a dependency confusion attack possible. This explicit configuration is a foundational, low-effort control against this specific and well-documented supply-chain attack.
5 / 5
During a PR review, a teammate asks why the team explicitly scopes and namespaces every internal package instead of trusting that their build system will naturally prefer the intended private registry by default. What is the reasoning?
A build system with no explicit registry priority configured can genuinely be tricked into pulling a same-named malicious package from an untrusted public registry instead of the intended private one. Explicit registry scoping and reserved-namespace naming both close off that ambiguity from two complementary angles. The tradeoff is the upfront configuration and process discipline needed to consistently apply both practices across every internal package a company publishes.
What does the "Dependency Confusion Vocabulary" vocabulary exercise cover?
This exercise tests real IT vocabulary related to dependency confusion vocabulary through 5 multiple-choice questions, each built from realistic workplace sentences rather than abstract definitions.
Is this vocabulary exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is completely free — no account, sign-up, or payment required.
How many questions does this exercise have?
This exercise has 5 questions. Each one shows a real-world sentence or scenario with multiple-choice options and an explanation once you answer.
What happens after I answer a question?
You'll see immediate feedback showing whether your answer was correct, along with a short explanation of why — then a button to move to the next question, and a full results screen at the end.
Can I retry the exercise if I get questions wrong?
Yes. Once you reach the results screen, click "Try again" to reset your answers and go through the exercise from the start as many times as you like.
Do I need to create an account to take this exercise?
No account is needed. Your answers are scored in your browser during the session — nothing is saved to a server, so you can jump straight in.
Is my progress saved if I leave the page?
No — progress within an exercise resets if you navigate away or reload. Each exercise is short enough to complete in a few minutes in one sitting.
Are these vocabulary exercises connected to other topics?
Yes — this module shares real-world context with 14 other vocabulary modules. See "Related vocabulary" below to keep building a connected skill set.
How is this different from reading a glossary or blog article?
Exercises like this one are active recall drills — you have to choose the correct term or phrasing yourself, which builds retention faster than passively reading a definition.
Where can I find more vocabulary exercises?
Browse the full Vocabulary exercises hub for hundreds of modules covering Agile, DevOps, security, databases, architecture, and more — organised by IT role and skill.