dependency-confusion

A dependency confusion attack occurs when internal package names resolve to attacker-controlled public registries, causing malicious code execution during dependency installation. This skill helps identify these supply chain vulnerabilities across multiple package managers.

You can test for npm and pip dependency confusion using structured reconnaissance commands to identify leakable internal package names and non-destructive callback-based proof-of-concept patterns for authorized red-team supply chain exercises.

Yes, this dependency confusion detection supports RubyGems, Maven, Composer, and Docker manifest review. It provides ecosystem-specific exploitation guidance to check for public squatting across these package registries.

The best way to check for public squatting is using structured reconnaissance workflows to identify leakable internal package names and verify if they resolve to attacker-controlled public registries during dependency installation.

To prevent dependency confusion attacks in CI/CD pipelines, apply actionable defensive controls and recommendations provided by the skill to ensure internal package names do not resolve to attacker-controlled public registries.

Yes, this skill is designed for authorized security testing and red-team engagement workflows. It provides supply chain reconnaissance commands and safe proof-of-concept patterns for non-destructive vulnerability testing.