> The so-called “dependency confusion attacks” work by uploading malicious packages to public code repositories and giving them names that are identical to legi

> The so-called “dependency confusion attacks” work by uploading malicious packages to public code repositories and giving them names that are identical to legitimate packages stored in the internal repository of Microsoft, Apple, or another large software developer. This is the key line. These attacks happen at installation specific organizations. The attackers haven't bypassed open source code review.