Large-user applications vulnerable to dependency confusion attacks