Supply Chain
Dependency Confusion
Also: namespace confusion
Tricking a build into fetching a public package with the same name as an internal one, usually by publishing it with a higher version number.
In more detail
If a package manager checks the public registry as well as a private one, it may prefer the public, higher-versioned package. Scoped names, registry pinning and reserving internal names publicly are the usual defenses.