domains / families / security / supply-chain-attack-recon

supply-chain-attack-recon

authentic

External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the target has a public GitHub org, when their build artifacts/SBOMs are reachable, when their docker images are on Docker Hub/GHCR, or when you find internal package names in their JS bundles.

When to use

• Target has a public GitHub organization (find via OSINT)
• JS bundles reference internal-looking package names (`@target-internal/...`, `target-utils`, `target-shared`)
• Build logs, SBOMs, or `package-lock.json` files are publicly accessible
• Target uses CI/CD that's partially public (GitHub Actions, GitLab CI, Bitrise)
• Docker images on Docker Hub/GHCR/Quay belong to target org
• Findings include `npmrc`/`pip.conf`/`gradle.properties` with internal registry URLs
• `.github/workflows/*.yml` files reference internal tooling
• Internal-network artifact registries (out of scope per external boundary)

When not to use

• actual package publishing
• typosquat attacks
• internal-network artifact registries
• compromising upstream open-source projects

Skill page

Source