Haxoris Wiki

Dependency Confusion

How Dependency Confusion works

If private package names also exist on public registries, build systems may inadvertently pull attacker‑controlled packages (“dependency confusion”). Mobile projects using Gradle, CocoaPods, or React Native dependencies are susceptible when versions aren’t pinned and registries aren’t isolated.

Dependency Confusion in practice

Detect Loose Versions and Public Resolution

rg -n "[:=] *['\"](\^|~|\*)|['\"]: *latest|\+\s*$" build.gradle Podfile package.json

Investigate any “latest”, wildcards, or “+” notations that could pull unintended versions.

Prefer Private Scopes/Registries

Check Gradle repo order and Pod sources:

rg -n "maven\{ url|google\(|mavenCentral\(|jcenter\(" build.gradle*
rg -n "source 'https://github.com/CocoaPods/Specs'" Podfile

How to fix and prevent Dependency Confusion

  1. Pin and verify
    • Lock exact versions; verify checksums/signatures; use lockfiles.
  2. Isolate registries
    • Route private packages to private registries with scoped names; block public fallbacks.
  3. Monitor
    • Alert on new public packages matching internal names; review SBOMs for drift.

Last updated

References