dependency-confusion
2 posts
Article
Cooldown does not fix the resolver
Bundler 2.6 cooldown defers new gem versions to interrupt published-and-pulled supply chain attacks. The resolver's trust model is the systemic exposure.
Article
The Roblox cheat never touched Roblox
How a Roblox cheat turned into a Vercel supply chain compromise - stealer to stolen token to dependency confusion to persistent build-pipeline access.