Cybersecurity

Detecting Dependency Confusion

Detect and prevent dependency confusion (public-over-private package name resolution) in npm, PyPI, and Maven by enumerating claimable internal package names with tools like `confused` and OWASP `dep-scan`, then enforcing source restrictions via `.npmrc`, `pip.conf`/`pyproject.toml`, and Maven `settings.xml`. Use when onboarding a repo to a supply-chain security program, auditing lockfiles/manifests for confusable dependencies, or after an incident that may have leaked internal package names.

Publisher / source

Cybersecurity Skills (Community)

Upstream record

mukul975/Anthropic-Cybersecurity-Skills

Version

Version 3

Published

2026-06-23

Publication review

Approved for publication

Content fingerprint

7197c1fe6cbe07ea5525e999d313aef810ac8736ad84e982b7e6a5fc120368f6