> For the complete documentation index, see [llms.txt](https://gitbook.cdxiaodong.life/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.cdxiaodong.life/cicd-an-quan/yi-lai-an-quan/dependency-hijacking.md).

# 依赖劫持

包所有者可以使用自定义域名的电子邮件向各种包管理器（如`npm`、`pypi`等）注册。如果域名过期，攻击者可以注册此域名并通过密码恢复获得对账户的访问权限。

{% embed url="<https://thehackerblog.com/zero-days-without-incident-compromising-angular-via-expired-npm-publisher-email-domains-7kZplW4x/>" %}