What is dependency confusion (or substitution) and how is it mitigated?

Short interview answer

An attacker publishes a public package with the same name as a company's private internal package and a higher version, hoping the resolver picks the public one. Mitigation includes scoped names, a registry configuration that pins internal scopes to the private registry, and explicit version constraints.