dependency confusion attack helped security researcher Alex Birsan earn $130,000 in bug bounties after demonstrating that build systems at Apple, Microsoft, PayPal, Uber, Yelp, Tesla, and 30+ other companies could be tricked into running code from public package registries. The attack did not exploit a single CVE. It exploited a package manager assumption: when public and private registries contain packages with the same name, the build system may choose the public package, especially when t...