Verified:GitHub

dependency-confusion

Detect package dependency confusion conflicts between private and public registries.

Updated Jun 11, 2026

Search Tags:#package management #vulnerability assessment #supply chain security #dependency confusion #software ecosystems

Ready to run

npx skills add https://github.com/utsavthakur/agenticskills --skill dependency-confusion-utsavthakur

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: dependency-confusion
Source: https://github.com/utsavthakur/agenticskills/tree/main/dependency-confusion
Command: npx skills add https://github.com/utsavthakur/agenticskills --skill dependency-confusion-utsavthakur

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Dependency Confusion identifies potential security risks in software supply chains by detecting cases where package names may lead to unexpected resolution and execution of attacker-controlled packages.

Core Features & Use Cases

Detects internal package name conflicts with public registries.
Evaluates ecosystems for dependency confusion vulnerabilities like npm, pip, RubyGems, Maven, Composer, Docker.
Assists in authorized red-team exercises and security assessments.

Quick Start

Use the 'dependency-confusion' skill to scan a repository for potential supply chain attack vectors.

Frequently Asked Questions about dependency-confusion

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a repository for dependency confusion vulnerabilities?▼

To scan for dependency confusion vulnerabilities, you check for package name conflicts between private and public registries to see if public versions can override private internal packages. This detects supply chain security risks across multiple software ecosystems.

What is a dependency confusion attack in software ecosystems?▼

A dependency confusion attack occurs when a package manager unexpectedly resolves an internal package name to an attacker-controlled public version instead of the intended private one. This happens when public registries are queried alongside private registries during package installation.

Does dependency confusion analysis work with npm, pip, and Maven registries?▼

Yes, dependency confusion analysis works with npm, pip, RubyGems, Maven, Composer, and Docker ecosystems. It evaluates conflicts between private and public package registries across these specific software environments to identify potential supply chain attack vectors.

Can I use this dependency confusion analysis for authorized red team exercises?▼

Yes, you can use dependency confusion analysis for authorized red team exercises and supply chain security audits. It assesses whether public packages could replace or override private internal packages, simulating real-world supply chain attack vectors.

Why does a public package override a private internal package during installation?▼

A public package overrides a private internal package when the package manager defaults to public registries and cannot find the internal name locally. This dependency confusion vulnerability allows attacker-controlled public packages to execute malicious code.