Risky dependency sources and install patterns
A call uses a package source or install pattern that deserves a closer look.
Why it is risky
Section titled “Why it is risky”Multiple registries, direct Git installs, and download-and-run pipelines can bypass expected package provenance or review. A similarly named public package may be selected in place of a private dependency.
Example
Section titled “Example”An agent installs a private dependency with an extra public index, creating a risk that an unrelated public package is chosen.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule matches selected pip extra-index use, npm Git sources, direct download-to-interpreter pipelines, and access to .pypirc. It does not resolve the package that was installed.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_SUPPLY_CHAIN_DEP_CONFUSION | supply_chain | Community | MEDIUM |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Review the exact source, package identity, pinned version or commit, and install-script behavior. Prefer reviewed artifacts and sources appropriate to the project.
False positives
Section titled “False positives”Approved Git dependencies, organization indexes, official installation scripts, and normal publishing configuration access can trigger it.
False negatives
Section titled “False negatives”A compromised package from the default registry, unsupported package managers, or indirect install scripts can be missed.
Technical details
Section titled “Technical details”The event category is supply_chain. The pattern is broader than dependency confusion alone and does not prove that the selected package was substituted.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.