supply-chain-attack-recon

External supply-chain attack surface reconnaissance identifies publicly reachable software artifacts, dependencies, and CI/CD configurations to map exposure risks. It involves OSINT across public GitHub orgs, npm/PyPI registries, and SBOMs to uncover typosquats and dependency confusion vulnerabilities.

Enumerate public GitHub orgs and their workflows referencing internal tooling to scan for typosquat and dependency-confusion signals. Analyze accessible SBOMs in SPDX or CycloneDX formats and cross-reference public dependencies against npm or PyPI registries to surface exposure risks.

Yes, you can use this approach to find risks in public Docker images and CI/CD workflows by applying external recon to targets with public build artifacts. It scans for workflow injections and examines Docker image contexts to ensure findings are contextualized to exposure risk.

External recon processes both SPDX and CycloneDX SBOM formats to map software dependencies. Analyzing these accessible SBOMs alongside public npm and PyPI registry data allows you to identify external supply-chain risk signals before exploitation occurs.

The best way to contextualize exposure risk from public build artifacts is ensuring findings are mapped to the target's specific CI/CD configurations and accessible registries. This involves verifying workflows referencing internal tooling and cross-referencing public dependencies for typosquats.