dependency-confusion

What problem does it solve?

Dependency confusion identifies when build systems or package managers may resolve an internal package name to an attacker-controlled public registry version, enabling malicious dependency installation and script execution.

Core Features & Use Cases

• Multi-ecosystem review: Covers npm, pip, RubyGems, Maven, Composer, and dependency patterns that affect Docker image builds.
• Recon-to-exploit workflow (authorized): Guides read-only public registry probing plus safe, non-destructive proof patterns suitable for controlled red-team exercises.
• Defense-focused remediation: Provides practical mitigations like scoped registries, index pinning, lockfile enforcement, and repository-order hardening.

Quick Start

Use the dependency-confusion skill to analyze your manifests and lockfiles for package-name collisions across private and public registries.