WebOTG-SSC-001 — Dependency Confusion & Namespace Squatting Defense

1. Executive Summary & Scope

Dependency confusion occurs when a software build environment searches both public (e.g. npmjs.com, Packagist) and private package registries for an internal dependency name. If an attacker publishes a package with the same name on the public registry with a higher version number, package managers default to downloading the malicious public package.

Standard Classification

OWASP Standard: OWASP Top 10 • Mapping: CWE-1395 • Target Architecture: Public Web Systems & APIs

2. Threat Model & Attack Vectors

Attackers scan open-source source maps or leak logs for internal package names (e.g. `@corp/internal-auth`), publish malicious packages with version `99.9.9`, and achieve remote code execution during CI/CD builds.

3. Code Analysis & Remediation Playbook

Vulnerable Implementation Pattern

// VULNERABLE: npm configuration without registry scoping // .npmrc registry=https://registry.npmjs.org/ // package.json references internal package "corp-telemetry" without scoped registry definition

Hardened Defense-in-Depth Implementation

// REMEDIATED: Explicit registry scoping and namespace reservation // .npmrc @webotg:registry=https://npm.pkg.github.com/webotg always-auth=true // Global public packages fallback to npmjs with strict integrity checks registry=https://registry.npmjs.org/ // composer.json: Explicit repository definitions { "repositories": [ { "type": "composer", "url": "https://packagist.org", "canonical": false }, { "type": "vcs", "url": "[email protected]:webotg/private-lib.git", "canonical": true } ] }

4. Audit Verification Checklist & Pass Criteria

Verification Phase	Audit Test Description	Mandatory Passing Criteria
Registry Resolution Order	Audit CI/CD pipeline configuration to ensure private artifact repositories have absolute precedence.	Private packages are never resolved against public registries.
Namespace Scope Claiming	Verify that all internal organizational scopes (e.g. @webotg) are registered and owned on public registries.	All namespaces are reserved to prevent external reservation.
Integrity Hash Enforcement	Verify build failure when lockfile SHA-512 integrity hashes do not match downloaded artifacts.	Build terminates immediately upon checksum discrepancy.

WebOTG Application Security Directorate

Senior Security Auditor

WebOTG provides benchmark reference documentation, automated matrix evaluators, and security test harnesses for government digital platforms, WQMS architectures, and STQC compliance frameworks.