Topic

Cache Poisoning

A fault or attack in which a caching layer stores or returns content under the wrong request key, so clients receive data they did not ask for.

Current clusters

build1 publisher

npm ci verifies downloads against the SHA-512 integrity hash stored in the lockfile

A dev.to writeup credits OpenAI's crawler traffic with surfacing a cache-key collision in RubyGems' CDN that served gemspecs under the wrong package names. For npm shops, the lockfile hash covers the tarball; the lookup that chose it is a separate problem.

Publishers:dev.to

Reality

Evidence30
Adoption: Insufficient
Hype gap+40
Incentives40
Confidence35