Confused : Tool To Check For Dependency Confusion Vulnerabilities

Confused is a tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python (pypi) requirements.txt, JavaScript (npm) package.json, PHP (composer) composer.json or MVN (maven) pom.xml.

What is this all about?

On 9th of February 2021, a security researcher Alex Birsan published an article that touched different resolve order flaws in dependency management tools present in multiple programming language ecosystems.

Microsoft released a whitepaper describing ways to mitigate the impact, while the root cause still remains.

Interpreting the tool output

confused simply reads through a dependency definition file of an application and checks the public package repositories for each dependency entry in that file. It will proceed to report all the package names that are not found in the public repositories – a state that implies that a package might be vulnerable to this kind of attack, while this vector has not yet been exploited.

This however doesn’t mean that an application isn’t already being actively exploited. If you know your software is using private package repositories, you should ensure that the namespaces for your private packages have been claimed by a trusted party (typically yourself or your company).

Known false positives

Some packaging ecosystems like npm have a concept called “scopes” that can be either private or public. In short it means a namespace that has an upper level – the scope. The scopes are not inherently visible publicly, which means that confused cannot reliably detect if it has been claimed. If your application uses scoped package names, you should ensure that a trusted party has claimed the scope name in the public repositories.

Installation

Usage

Usage:
./confused [-l LANGUAGENAME] depfilename.ext

Usage of ./confused:
-l string
Package repository system. Possible values: “pip”, “npm”, “composer”, “mvn” (default “npm”)
-s string
Comma-separated list of known-secure namespaces. Supports wildcards
-v Verbose output

Example

Python (PyPI)

./confused -l pip requirements.txt

Issues found, the following packages are not available in public package repositories:
[!] internal_package1

JavaScript (npm)

./confused -l npm package.json
Issues found, the following packages are not available in public package repositories:
[!]internal_package1
[!]@mycompany/internal_package1
[!]@mycompany/internal_package2
#Example when @mycompany private scope has been registered in npm, using -s
./confused -l npm -s ‘@mycompany/*’ package.json
Issues found, the following packages are not available in public package repositories:
[!]internal_package1

Maven (mvn)

./confused -l mvn pom.xml

Issues found, the following packages are not available in public package repositories:
[!]internal
[!]internal/package1
[!]internal/_package2

R K

Recent Posts

SpyAI : Intelligent Malware With Advanced Capabilities

SpyAI is a sophisticated form of malware that leverages advanced technologies to capture and analyze…

24 hours ago

Proxmark3 : The Ultimate Tool For RFID Security And Analysis

The Proxmark3 is a versatile, open-source tool designed for radio-frequency identification (RFID) security analysis, research,…

24 hours ago

Awesome Solana Security : Enhancing Program Development

The "Awesome Solana Security" collection is a comprehensive resource designed to help developers build more…

24 hours ago

IngressNightmare-POCs : Understanding The Vulnerability Exploitation Flow

The "IngressNightmare" vulnerabilities, disclosed in March 2025, represent a critical set of security issues affecting…

1 day ago

AdaptixC2 : Enhancing Penetration Testing With Advanced Framework Capabilities

AdaptixC2 is an advanced post-exploitation and adversarial emulation framework designed specifically for penetration testers. It…

1 day ago

Bincrypter : Enhancing Linux Binary Security through Runtime Encryption And Obfuscation

Bincrypter is a powerful Linux binary runtime crypter written in BASH. It is designed to…

1 day ago