/**
 * Dependency Confusion Detector
 *
 * Analyzes a project's package.json to detect potential dependency confusion attacks.
 * Checks if dependencies exist on the public npm registry and flags suspicious ones:
 * - Unscoped packages that look like internal names
 * - Packages with no README, very recent publish, or low download counts
 * - Packages where the public version was published AFTER the project started using it
 */
import type { Finding, ScanReport, Severity } from "./types.js";
export interface ConfusionScanOptions {
    /** Path to the project directory (containing package.json) */
    target: string;
    /** Output format */
    format: "text" | "json" | "markdown" | "sarif" | "sbom";
    /** Minimum severity to report */
    minSeverity?: Severity;
    /** Include devDependencies in the check */
    includeDevDeps?: boolean;
}
/**
 * Scan a project for dependency confusion risks.
 */
export declare function scanDependencyConfusion(options: ConfusionScanOptions): Promise<ScanReport>;
/**
 * Scan a project directory for PyPI dependency confusion risks.
 * Reads requirements.txt and pyproject.toml.
 */
export declare function scanPypiDependencyConfusion(projectDir: string): Promise<Finding[]>;
//# sourceMappingURL=dependency-confusion.d.ts.map