Dependency confusion: how package resolvers choose the attacker's version

thats amazing. 10+ years and still learning a lot of things