“This type of vulnerability, which I have started calling dependency confusion, was detected inside more than 35 organizations to date, across all three tested programming languages.”
He found internal package names in public code and uploaded public packages with the same names. Machines at Apple, Shopify and PayPal pulled his code instead of their own and ran it. Each paid out $30,000. Package managers have quietly preferred the public registry for years. Nobody checked until someone got paid to.