supply-chain-attack-recon

Dependency confusion detection works by analyzing a target's public GitHub org and SBOM data to identify internal package names. It then checks public npm, PyPI, and go module registries to find unclaimed packages that attackers could hijack.

A GitHub Actions workflow injection occurs when untrusted input executes within a CI/CD pipeline. You find this exposure by reviewing public workflow configurations for insecure variable handling, mapping potential injection points, and identifying exposed secrets across the target organization.

Yes, you can use SBOM data to enumerate transitive dependencies and known CVEs. By mining exposed SBOM artifacts from public repositories or container images, you can correlate the listed software components against vulnerability databases to map known security risks.

The best way to discover package typosquats during supply chain recon is to map external dependencies from public registries and SBOMs. You then identify closely named public packages that mimic legitimate dependencies to surface potential malicious code uptake points.

No, this supply chain recon does not require access to private configurations. It uses OSINT gathering techniques to analyze publicly available GitHub org repositories, exposed Docker or OCI registries, and public artifact feeds to surface external risk.

You find exposed Docker or OCI registries by performing OSINT on a target's public GitHub org and CI/CD surface. This discovers registry exposure and leaked SBOM data, enabling vulnerability correlation and prioritized remediation across the software supply chain.