Dependency confusion — why your npm install can be dangerous

Mechanism

If an internal package name is not reserved on public npm/PyPI, an attacker can publish a “higher” version.

What to do

· Scope / private registry

· Pin + lockfile

· CI: scan internal names vs public

· SCSM in War Room (ASSESS)

No malware PoC — detection and remediation only.