Package dependency confusion