Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies
Researchers uploaded malicious packages with internal company names, gaining access to Apple, Microsoft, and others due to dependency confusion.
- from
- CI/CD Attacks
- added
- 2026-10-10
- likes
- 0
similar
-
How I hacked into Google's internal corporate assets observationsinsecurity.com
More ways to find dependencies in code for Dependency Confusion.
-
AWS Targeted by a Package Backfill Attack mend.io
Scan commit history for internal packages to execute dependency confusion.
-
Security alert: social engineering campaign targets technology industry employees github.blog
Phishing GitHub users to download and execute repositories.
-
How We Hacked a Software Supply Chain for $50K landh.tech
Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.
-
-
GitHub comments abused to push malware via Microsoft repo URLs bleepingcomputer.com
Hidden GitHub comment link.
CI/CD Attacks › Techniques > Initial Code Execution: “Researchers uploaded malicious packages with internal company names, gaining access to Apple, Microsoft, and others due to dependency confusion.”