Verified:GitHub

dependency-confusion

Detect dependency confusion risks where internal package names resolve to public registries.

2|Updated May 15, 2026

Search Tags:#package manager #supply chain #CI/CD security #red teaming #dependency confusion #registry misconfiguration #lifecycle scripts

Ready to run

npx skills add https://github.com/lNwNl/Methodos --skill dependency-confusion

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-confusion
Source: https://github.com/lNwNl/Methodos/tree/main/docker/opencode/skills/dependency-confusion
Command: npx skills add https://github.com/lNwNl/Methodos --skill dependency-confusion

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Dependency confusion identifies when build systems or package managers may resolve an internal package name to an attacker-controlled public registry version, enabling malicious dependency installation and script execution.

Core Features & Use Cases

Multi-ecosystem review: Covers npm, pip, RubyGems, Maven, Composer, and dependency patterns that affect Docker image builds.
Recon-to-exploit workflow (authorized): Guides read-only public registry probing plus safe, non-destructive proof patterns suitable for controlled red-team exercises.
Defense-focused remediation: Provides practical mitigations like scoped registries, index pinning, lockfile enforcement, and repository-order hardening.

Quick Start

Use the dependency-confusion skill to analyze your manifests and lockfiles for package-name collisions across private and public registries.

Frequently Asked Questions about dependency-confusion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

What is a dependency confusion attack in CI/CD pipelines?▼

A dependency confusion attack occurs when a package manager resolves an internal package name to an attacker-controlled public registry version during install or build, enabling malicious dependency installation and script execution.

How do I check my npm and pip manifests for dependency confusion risks?▼

You can analyze your package manifests and lockfiles for package-name collisions across private and public registries to identify supply-chain hijacking paths in npm, pip, RubyGems, Maven, and Composer.

Can I safely test for dependency confusion using lifecycle scripts?▼

Yes, you can perform authorized, non-destructive proof-of-concept testing using read-only public registry probing and safe lifecycle hook patterns suitable for controlled red-team exercises.

Does this dependency confusion check cover Docker container build pipelines?▼

Yes, this dependency confusion analysis applies to developer workstation installs, CI/CD pipelines, and container build pipelines where manifests, lockfiles, or registry configuration may allow cross-index version selection.

What is the best way to prevent registry misconfiguration during package installation?▼

Effective defensive controls include implementing scoped registries, index pinning, lockfile enforcement, and repository-order hardening to prevent package managers from resolving to attacker-controlled public registry versions.

Why does my package manager install a public version instead of my internal package?▼

Registry misconfiguration allows cross-index version selection, causing your package manager to resolve internal package names to attacker-controlled public registry versions when internal packages are not properly scoped or pinned.