# Dependency confusion and update hijack Auto-linked package names, unregistered update domains, or typosquatted installers trusted by default _Area: Web infrastructure and server-side requests. Seen in 3 disclosed reports; one confirmed bounty: $1,000; latest 2026-04-14. Updated 2026-11-02._ ## How it works Software trusts a name it does not control. A manifest declares a package name, an updater config names a domain, or a user types a vendor URL — and the code or user treats that name as authoritative without checking who actually owns it. If the name is unclaimed (unregistered domain, unpublished npm package) or lookalike (typosquatted site), an attacker can claim it and inherit the trust the original software already had. The victim installs or connects to attacker content with no warning. ## Where it shows up - Updater config files (.ini, XML) naming a primary update URL; check whether the domain is registered and who owns it. - Auto-generated registry links from manifest files (package.json, requirements, etc.) where the package name is not verified as published. - Installers whose size, signer, or download source differs from the vendor's official release. - Services or scheduled tasks created by an installer that open outbound tunnels (SSH, raw-IP connections). - Signed binaries that still fetch and execute remote MSI/EXE payloads with elevated privileges. ## How to review For every name the software trusts, ask: who controls it right now, and what happens if a stranger takes it? The invariant: a trusted name must be owned by the party the software intends, and the fetched artifact must be verified (signature, hash, pinned source) before execution. Check that update URLs resolve to registered, vendor-controlled domains; that auto-linked package names are confirmed published before linking; and that installers verify signer identity against the expected vendor, not just presence of a signature. ## How finders spotted it - Triaged WMI persistence and scheduled-task alerts, traced to a signed executable, then read the leftover .ini update config and noticed the primary update domain was unregistered [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs.md). - Noticed GitLab assumes packages are published to npm when no homepage key exists, observed many local-only packages never published, and tested by claiming one of GitLab's own names [E2](https://bugbountylibrary.com/r/h1%3A462503.md). - SOC flagged anomalous SSH from a DICOM installer; noted SSH to a raw IP not FQDN, installer absent from vendor site, and 178MB vs 13MB legitimate; sandboxed both versions and traced browser referrer and S3 artifacts to a cloned site [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack.md). ## Variants seen - Dangling update domain in signed auto-updater, silently installing MSI with SYSTEM rights [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs.md). - Auto-linked unpublished package name on a trusted project page, claimable by an attacker [E2](https://bugbountylibrary.com/r/h1%3A462503.md). - Typosquatted vendor site serving a trojanized installer bundling OpenSSH and a persistent service [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack.md). ## Impact and severity E1 reached 23,565 infected hosts with AV already disabled, turning one domain registration into mass SYSTEM compromise [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs.md). E2 let an attacker serve a malicious package from a trusted project page, scalable by automating name claims [E2](https://bugbountylibrary.com/r/h1%3A462503.md). E3 gave persistent SSH backdoor access to two medical orgs [E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack.md). Impact rises when the trusted name is combined with pre-existing elevated access or AV exclusions [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs.md), or when the installer runs with SYSTEM privileges [E1](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs.md)[E3](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack.md). ## Seen in real software Open-source packages and projects, and products, where this pattern was found. If the target runs one, compare the version it runs with the fix. - **Advanced Installer** (updater) (version not stated): When PUPs Grow Fangs: Dragon Boss Solutions' $10 Supply Chain Risk. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs.md - **MicroDicom** (version not stated): When Trust Becomes a Trap: Foiling a Medical Software Hack. Report: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack.md - **GitLab**: Claiming package names in GitLab's automatic package referencer.. Report: https://bugbountylibrary.com/r/h1%3A462503.md ## Evidence - E1: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-pups-grow-fangs.md - E2: https://bugbountylibrary.com/r/h1%3A462503.md - E3: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-when-trust-becomes-a-trap-how-huntress-foiled-a-medical-software-update-hack.md