wtf( )unctionsystem design, drawn
← all problemsSupply ChainHard

The internal package that wasn't

Internal libraries live on a private registry. Builds are configured with both the private registry and the public one, so a single install command can resolve either.

Someone published a package to the public registry using an internal name, with a very high version number. Builds picked it up — not because the public registry was preferred, but because nothing said the name belonged to you.

Make the resolver stop treating your internal names as open to anyone.
Components — tap one, then tap a slot on the diagram
!A package with an internal name appeared on the public registry and builds installed it.

Outside every boundary: Private registry (your package, v1.2.0), Public registry (same name, v99.0.0; FAILED: wins on version), Build (installs by name), an empty slot for the how the name is resolved Connections: Build calls how the name is resolved (step 1) how the name is resolved calls Private registry — this name lives here (step 2) how the name is resolved must NOT reach Public registry — never for internal names

Private registryyour package, v1.2.0
Public registrysame name, v99.0.0wins on version
Buildinstalls by name