Tag: Dependency Confusion

Must-Read Posts

Risky Business: Self-Deleting npm Packages Explained

Risky Business: The Anti-Proctoring Packages That Delete Themselves

JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

Attacks Analysis, Must Read, Secrets Security

AWS Lambda npm Dependency Confusion Attack: The 24712-pl Campaign

Uncover the details of The 24712-pl Campaign and the zero-dependency packages exploited during a security incident.

May 8, 2026

Xygeni Security Team

12 min read

Attacks Analysis, Must Read, Secrets Security

alone5511 npm Dependency Confusion Attack

An npm dependency confusion attack used eight malicious packages to fingerprint hosts and send RCE telemetry to Telegram.

May 7, 2026

Xygeni Security Team

8 min read

SDLC, Software Supply Chain

Lack of Version Pinning and Dependency Confusion

Read about Lack of Version Pinning and Dependency Confusion: find out how to protect your business from these kind of attacks!

November 11, 2022

Félix Carnicero

8 min read