Agent skill · security · yaklang
dependency-confusion
Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.
Why this skill is useful
Adds detailed methodologies and scripts for identifying and exploiting dependency confusion vulnerabilities across multiple package ecosystems.
What it needs
About 5k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Dependency Confusion — Supply Chain Attack Playbook AI LOAD INSTRUCTION: Expert dependency-confusion methodology. Covers how private package names leak, how public registries can win version resolution, ecosystem-specific pitfalls (npm scopes, pip extra indexes, Maven repo order), recon commands, non-destructive PoC patterns (callbacks, not data exfil), and defensive controls. Pair with supply-chain recon workflows when manifests or CI caches are in scope. Only use on systems and programs you are authorized to test. 0. QUICK START What to look for first Manifests listing package names that look internal (short unscoped names, org-specific tokens, product codenames) without a hard-private registry lock. Evidence the same name might exist—or be squattable—on a public registry with a higher semver than the private feed publishes. Lockfiles missing, stale, or not enforced in CI so install/build can drift toward public metadata. Fast mental model: If the resolver can see both private and public indexes, and version ranges allow it, the “newest” matching version may be the attacker’s. Routing note: if the task comes from supply-chain, repository exposure, or CI-build recon, first use recon-for-sec to list internal package names and possible public-registry collisions. --- 1. CORE CONCEPT 1. Private packages: An organization ships libraries only on an internal registry (or under conventions that imply “ours”), e.g. a scoped name like @org-scope/internal-utils or an unscoped name such as acme-billing-sdk. 2. Attacker squats the name: The same package name is published on a public registry (npmjs, PyPI, RubyGems, etc.). 3. Resolver preference: Many setups resolve highest matching version across all configured indexes (or merge metadata), so a public 9.9.9 can beat a private 1.2.3 if ranges allow. 4. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/dependency-confusion