dependency-confusion

Dependency confusion is a supply chain vulnerability where package managers mistakenly resolve private package names to attacker-controlled public registries. This Skill detects package name conflicts and analyzes exploitation patterns across ecosystems like npm, pip, and Maven.

You can scan for dependency confusion vulnerabilities by running `bingo dependency-confusion <target>`. This leverages integrated reconnaissance tools to identify private package names that may resolve to attacker-controlled public registries.

Yes, dependency confusion analysis supports Python pip and RubyGems ecosystems. It also applies to npm, Maven, Composer, and Docker, covering both reconnaissance and exploitation pattern analysis for various package managers.

Yes, you can evaluate defensive controls to mitigate supply chain security risks. This Skill reviews your package management practices and recommends specific defensive controls to prevent dependency confusion attacks across your software supply chain.

Private package name resolution fails when package managers check public registries before private ones, allowing attacker-controlled public packages to override internal dependencies. This Skill identifies these package name conflicts to secure your software supply chain.

You need to understand package management practices and use reconnaissance tools for vulnerability identification. This Skill integrates various reconnaissance tools to scan for package name conflicts across different package ecosystems.