Apache Cordova App Harness Targeted in Dependency Confusion Attack

Security researchers discovered a dependency-confusion vulnerability in the archived Apache Cordova App Harness where an internal dependency was referenced without a relative path, enabling an attacker to publish a malicious npm package under the same name; the bogus package received over 100 downloads before Apache took ownership. The report underscores the supply-chain risks of abandoned open-source projects and recommends defensive measures such as using private registries, publishing placeholder packages, and treating third-party/archived dependencies as potential weak links.