DCFinder: A dependency confusion detection method based on multi-dimensional dependency analysis

Dependency Confusion Attacks (DCA), which exploit resolver-level source bypass in multi-repository environments, have emerged as a critical threat to software supply chain security. Existing dependency confusion detection tools are limited by incomplete dependency extraction, insufficient transitive dependency analysis, and a lack of cross-repository version-precedence evaluation. We propose DCFinder, an automated dependency confusion detection method based on multi-dimensional dependency analysis. DCFinder first extracts dependencies from heterogeneous configuration sources by combining format-specific parsing for static configuration files with AST-based static analysis for executable build scripts. It then reconstructs multi-layer dependency trees through a source-aware dependency expansion strategy implemented with BFS traversal, where dependency expansion obtains metadata from configured private indexes when available and from PyPI otherwise, and continues recursively through the discovered sub-dependencies. Finally, it performs cross-repository version analysis to determine whether resolver behavior may allow a public package to override an intended private source. We evaluate DCFinder on 28 real-world Python projects with observable multi-index configurations. The results show that DCFinder achieves 88.7% precision and 83.3% recall for resolver-level dependency-confusion condition detection, whereas the evaluated baseline tools report no positive cases under the same setting due to their more limited modeling of cross-index resolution behavior. These results demonstrate that combining heterogeneous dependency extraction, source-aware dependency expansion, and cross-repository version analysis enables more comprehensive auditing of dependency-confusion risks.