County developers notice an internal AI helper package name that also exists on a public registry. What supply-chain pattern is that?
Select an answer to reveal the explanation.
Short Explanation
Same package name inside and outside is dependency confusion—the build might grab the wrong one. Namespace it tightly.
Full Explanation
When an internal AI helper package name also exists on a public registry, developers face dependency-confusion risk: package managers may prefer a public artifact over the internal civic package with the same name, pulling untrusted code into county builds. Defenses include scoped registries, unique namespaces, prefer-offline or internal-first resolution, and publishing internal packages only to private indexes with authentication. Branding merchandise does not prevent mis-resolution.
Using unscoped names without registry-first resolution, actually publishing the internal package publicly under the same name, and assuming resolvers favor internal names are each a specific mechanism or false assumption that can cause the collision — but the pattern developers actually observed, a name existing in both places, is dependency confusion itself, which these describe partially rather than naming directly.
Exam caveat: confusion can also occur via transitive dependencies that request the colliding name—protect the entire resolve graph, not only direct imports. Operational check: rename or scope the internal helper under a city-controlled namespace, configure the package manager to use only the private registry for that scope, attempt to publish a honeypot public package with the old name in a lab, and confirm CI never resolves it for municipal AI builds.