Dependency Confusion Attacks

Fortify

Explanation

Make the source of every internal name unambiguous. Each client talks to one endpoint, and that endpoint never asks a public registry about names you own. Then check artefacts against hashes you recorded.

Insight

Namespace filtering ends this attack. Repository order helps, but filtering stops the public proxy from ever being asked about com.acme. Owned scopes and verified namespaces stop the name being claimed in the first place.

Practical

• pip: use a single index-url pointing at your repository manager, which proxies PyPI. Remove every extra-index-url.
• uv: pin internal packages to an explicit index, so they can never come from PyPI.

[tool.uv.sources]
acme-billing-client = { index = "acme" }

[[tool.uv.index]]
name = "acme"
url = "https://pypi.acme.internal/simple"
explicit = true

• npm: scope every internal package, route the scope in a committed .npmrc (@acme:registry=https://npm.acme.internal/), and create the acme organisation on npmjs.com.
• Maven namespace: register the domain behind every internal groupId, or move to a groupId you own, and verify it on Central. You don't need to publish anything to hold it.
• Repository manager: in Nexus, attach a routing rule to the Central proxy that blocks com/acme/.*. In Artifactory, add com/acme/** to the remote's Excludes Pattern and enable Priority Resolution on the local repository. Do the same for internal npm and Python names.
• Gradle: use exclusiveContent so internal groups only come from the internal repository, and block project-level repositories.

// settings.gradle.kts
dependencyResolutionManagement {
    repositoriesMode.set(RepositoriesMode.FAIL_ON_PROJECT_REPOS)
    repositories {
        exclusiveContent {
            forRepository {
                maven { url = uri("https://nexus.acme.io/repository/internal/") }
            }
            filter {
                includeGroupByRegex("com\\.acme(\\..*)?")
            }
        }
        mavenCentral()
    }
}

• Verification: keep hashed lockfiles (uv pip compile --generate-hashes, package-lock.json). For Gradle, run ./gradlew --write-verification-metadata sha256,pgp help and review changes to gradle/verification-metadata.xml like code. For Maven, record trusted checksums into .mvn/checksums/ and enforce them from .mvn/maven.config. A swapped artefact then fails the hash check.
• Pin exact versions and let Renovate or Dependabot propose upgrades.

Tools/Techniques

• Artifactory Priority Resolution and include/exclude patterns; Nexus routing rules.
• uv index configuration.
• Gradle content filtering and dependency verification.
• For claiming your names across registries, see Registry Namespace Collisions.

Metrics/Signal

• Zero extra-index-url or unsafe-best-match settings in CI.
• 100% of internal npm packages under an owned scope.
• Gradle builds with exclusiveContent for internal groups and committed verification metadata.