Revealed in March 2021, 35 global technology companies were hacked via the āDependency Confusionā method. Hereās what you can do to protect against future attacks.
When an ethical hacker announced heād successfully breached 35 technology companyās vulnerable software supply chains, including Apple, Microsoft and Netflix, it was no surprise to Sonatype.
Our research team detected over 300 suspicious packages back in 2020, led by Alex Birsanās research efforts. We added these components to our data, alerted the community, and have been actively protecting customers ever since.
By taking advantage of a novel concept known as ādependency confusionā aka ānamespace confusionā, Birsan pushed his research packages downstream in an automated fashion to the development environments of multinational technology companies. The method he described is now widely deployed by other actors, with 1444% growth in similar packages in a week since he published his findings.
