Dependency confusion: Compromising the supply chain