Dependency Confusion Attack Simulator

Every package manager has to answer one question before it installs anything: when a name exists in more than one registry, which copy wins? This simulator renders that resolution decision as a real 3D CI pipeline — a private registry platform on the left, the public registry on the right, a central CI resolver, and a fan of consuming services below that receive whatever the resolver picks. Set the attacker's public version, choose the resolution policy, and press Run CI Resolve to watch a real semver comparison decide whether every downstream service installs your internal SDK or the attacker's public impostor — then switch to registry pinning or a scoped namespace to see why those are the actual fixes, not luck.