domains / families / security / dependency-confusion

dependency-confusion

separate

Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.

When to use

• npm/pip/gem/Maven/Composer/Docker manifest review
• authorized red-team supply-chain exercises
• supply-chain recon workflows
• manifests or CI caches in scope

When not to use

• systems and programs you are not authorized to test

Skill page

Source