Dependency confusion
Supply-chain attack: register a package on public npm/PyPI with the same name as an internal company package — the package manager picks the higher version.
Demonstrated in 2021 by Alex Birsan against Apple, Microsoft, Tesla — collected huge bounties. Defences: namespace configuration, scoped packages, private registries with upstream pinning, lockfiles.