RCE via npm misconfig -- installing internal libraries from the public registry

Summary

The hacker spotted some orphaned references to Uber-branded Node.js library packages and claimed them on the public NPM registry to run their own proof-of-concept code.

Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies