Dependency Resolution (DR)

October 31, 2026

Taxonomies › Software factory › Dependency Resolution

Station 07 of 17 · Line 1, Source to Artifact · 13 threats · prefix DR

Resolution is the moment the factory decides whose code to run, usually automatically and often by name alone. These cards cover package managers, manifests, lockfiles, install-time execution and dependency update bots.

Scope: Package managers, manifests, lockfiles, install scripts, dependency update bots.

Table: Dependency Resolution (DR), 13 threats with their mitigation principles and design measures. The full text is in the PDF and Excel downloads on the software factory taxonomy overview page.

Text version: every entry on this page is in the PDF and Excel downloads on the overview page, where it can be searched and copied.

The threats

DR·A Install-Time Code Execution
DR·K Dependency Confusion
DR·Q Floating Version Ranges
DR·J Typosquatting and Lookalikes
DR·10 Ownership Transfer
DR·9 Lockfile Tampering
DR·8 Maintainer Sabotage
DR·7 Automated Update Merge
DR·6 Manifest Confusion
DR·5 Transitive Blind Spot
DR·4 Resolver Differential
DR·3 Vendored Copy Drift
DR·2 Unpublished Dependency

Where this station touches others

Dependency Resolution and Firewall and Quarantine: resolution decides what is asked for; the firewall decides what is served.
Build Systems and Dependency Resolution: the build system runs the build logic and fetches its own plugins; resolution chooses the application’s components.

Seen in the wild

DR·A Install-Time Code Execution: ua-parser-js (2021); Shai-Hulud (2025).
DR·K Dependency Confusion: Birsan research (2021); PyTorch torchtriton (2022).
DR·Q Floating Version Ranges: colors and faker (2022).
DR·J Typosquatting and Lookalikes: crossenv (2017).
DR·10 Ownership Transfer: event-stream (2018); PyPI Revival Hijack (JFrog, 2024).
DR·9 Lockfile Tampering: Lockfile injection (Liran Tal, 2019).
DR·8 Maintainer Sabotage: node-ipc, CVE-2022-23812 (2022).
DR·6 Manifest Confusion: npm manifest confusion (Darcy Clarke, 2023).
DR·2 Unpublished Dependency: left-pad (2016).

Sources for each case are listed on the overview page.

STRIDE, CAPEC and CWE

Of the 13 entries here, STRIDE fits 8 cleanly and 5 only loosely. CAPEC 3.9 has a pattern that describes 6 of them directly, only a generic parent pattern for 5, and nothing for 2. CWE 4.20 names the weakness directly for 5, has only a broader weakness for 8,. The table below gives the mapping entry by entry, with the names of the CAPEC patterns and CWE weaknesses; what the mapping shows across the whole taxonomy is in Mapping the Software Factory Threat Taxonomy to STRIDE, CAPEC and CWE. The Excel, SKOS and STIX downloads carry the same mapping as text.

← Build Systems (BS) · Software factory overview · Scanners and Gates (SG) →