Apiiro released Dependency Combobulator, a modular and extensible open-source toolkit to detect and prevent dependency confusion attacks. The toolkit allows organizations to safeguard against this newly uncovered type of risk, which has been on the rise this year as a key vector in supply chain attacks targeting dependencies within software packages.
Dependency confusion compromises the open-source software ecosystem by tricking end-users, developers, and automation systems into installing a malicious dependency instead of the correct one they intended to install, resulting in compromised software.