No packages removed from the npm registry (unpublished)

Dependency confusion attacks work by registering a malicious package on the public npm registry using the same name as your private internal package. When npm resolves dependencies, it may fetch the public (attacker-controlled) version instead of your private one — silently installing code that exfiltrates credentials or establishes a backdoor. This attack class has compromised systems at Microsoft, Apple, PayPal, and dozens of other organizations. OWASP A08 (Software and Data Integrity Failures) and CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) define the failure. SLSA L2 requires that every dependency be verifiable against a trusted source. An @yourcompany/internal-lib in package.json with no private registry configured in .npmrc is an open invitation for this exact attack.

Scope all private packages under a unique organization namespace and configure .npmrc to route that scope exclusively to your private registry:

# .npmrc
@yourcompany:registry=https://your-private-registry.example.com

For each private package name, also publish a placeholder package on the public npm registry to claim the name and prevent an attacker from registering it. Use npm publish --access public with a package body that simply redirects to the private source or contains a security notice.