.NET › Assemblies & NuGet

What is package source mapping, and how does it protect against dependency confusion attacks?

Advanced

Answer

Package source mapping lets you explicitly restrict which package source(s) are allowed to provide packages matching specific name patterns (e.g., only your internal feed can provide packages prefixed 'MyCompany.*'), preventing a dependency confusion attack where a malicious actor publishes a same-named package to the public NuGet.org registry hoping your build accidentally pulls the public (malicious) version instead of your intended private one.

<!-- NuGet.Config -->
<packageSourceMapping>
  <packageSource key="nuget.org">
    <package pattern="*" />
  </packageSource>
  <packageSource key="CompanyFeed">
    <package pattern="MyCompany.*" />  <!-- only CompanyFeed can provide these -->
  </packageSource>
</packageSourceMapping>

Real-world example After a widely publicized dependency confusion attack against another company, a security team adds package source mapping to every internal repository's NuGet.Config to guarantee internal package names can never accidentally resolve to a public NuGet.org impostor.

Common follow-ups: How would an attacker exploit the absence of source mapping?;What naming convention best supports effective source mapping patterns?

CI/CD Publishing & Deployment;Assemblies & NuGet