Dependency Confusion: The Threat Hiding in Plugin Names

--
title: "Dependency Confusion: The Threat Hiding in Plugin Names"
description: "How dependency confusion attacks ride on package and plugin names."
tags: ["dependency-confusion", "supply-chain", "plugin-security", "typosquatting"]

canonical_url: https://dshquality.com/blog/dependency-confusion

I spent the last week going deep on dependency confusion in plugin names, and a few things caught me off guard. Most guides skip the boring parts, which is exactly where the real problems show up later.

One issue that nobody warns you about is understanding how a public package can shadow your private one. People treat it as a checkbox, then wonder why nothing holds together. Another that bit me was watching for typosquatted names that look almost right. It sounds minor until a busy week exposes it. The part I underestimated the most was using a private registry and an allowlist before you trust a name.

My fix was boring on purpose. I opened the settings I already had and fixed the smallest thing first, then built one habit around it. Before adding anything else I checked whether readers actually noticed a difference.

For dshquality.com this is not optional housekeeping. An hour spent now beats a much larger cleanup six months later.