Exploring extensions of dependency confusion attacks via npm package aliasing

This report demonstrates a variant of dependency confusion in npm that leverages npm's package aliasing feature: an author can alias an internal package name to a real public package version, which causes the npm registry and developer tooling to display a made-up package name that does not exist unless an attacker publishes it, enabling potential supply-chain compromise; the authors reproduced the issue, published a proof-of-concept package, and recommend detection and mitigation measures (including Snyk tooling).