Potential dependency confusion in a GitLab repository due to package name or scope available in regi

Rule Details

Cortex AppSec Rule ID	APPSEC_CICD_276
Category	Dependency Chains
Severity	HIGH

Impact

Attackers can discover internal package names by scanning public repositories and artifacts. Then they can upload malicious packages with names identical to an organization's internal package names and scopes, hoping that improper package fetching configuration will cause internal clients to fetch the malicious package rather than the legitimate internal package with the same name. This is known as a Dependency Confusion attack.