Dependency Confusion Attack

Some programming languages, like Python, come with an easy, official method of installing dependencies for your projects. These installers are usually tied to public code repositories where anyone can freely upload code packages for others to use. You have probably heard of these tools already — Node has npm and the npm registry, Python’s pip uses PyPI (Python Package Index), and Ruby’s gems can be found on… well, RubyGems. Have you ever run a command like 'pip3 install some_package'? Did you know that when downloading and using a package from any of these sources, you are essentially trusting its publisher to run code on your machine? Can this blind trust be exploited by malicious actors?