dependency-confusion

Dependency confusion occurs when internal package names resolve to public registries, enabling malicious code execution during installs. This Skill identifies such risks by mapping internal package identifiers across manifests and CI pipelines to public registries.

To audit dependency-confusion risks, identify internal-looking package names in manifests and CI pipelines, then assess exposure across npm, PyPI, RubyGems, Maven, Composer, and Docker workflows. This Skill provides structured guidance for recon, safe PoC patterns, and defensive controls.

Yes, you can test for dependency confusion in CI pipelines and build environments. This Skill applies to development, CI pipelines, and build environments to detect potential package name collisions and risky configurations across multiple package managers.

Yes, this dependency-confusion assessment supports Docker manifests and Composer, along with npm, PyPI, RubyGems, and Maven. It maps internal package names across these registries to detect potential collisions and risky configurations.

The best way to run an authorized dependency-confusion PoC is in a controlled lab environment using structured guidance with explicit guardrails. This Skill provides safe PoC patterns for red-team and blue-team engagements to assess exposure without unintended impact.

Testing dependency confusion requires explicit guardrails for authorized testing, including operating in a controlled lab environment. This Skill implements structured auditing steps and safe PoC patterns to ensure assessments remain within authorized boundaries during red-team and blue-team engagements.