Offensive Supply Chain
Comprehensive offensive methodology for software supply chain attacks covering the full...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-supply-chain -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Security
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) and T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Integrates tooling such as confused for dependency confusion scanning and dependency-check for known vulnerable component detection. Each technique section provides reproducible proof-of-concept patterns, detection guidance for defenders, and engagement-safe execution notes for authorized red team operations.
Offensive Supply Chain Attacks
Software supply chain attacks exploit the trust relationships between developers, package registries, build systems, and deployment pipelines. You target the components and processes that organizations depend on but rarely audit with the same rigor as their own code. A single compromised dependency can propagate across thousands of downstream consumers, making supply chain the highest leverage attack surface in modern software ecosystems.
This skill covers the offensive lifecycle: reconnaissance of internal package names, exploitation of registry resolution logic, build system hook abuse, CI/CD pipeline tampering, and container image supply chain attacks. Every technique maps to authorized red team engagement patterns with safe callback mechanisms.
Quick Workflow
- Enumerate internal package names from target artifacts (lock files, source maps, error messages, GitHub repos).
- Identify the package ecosystem (npm, PyPI, NuGet, Maven, Go, Ruby) and registry configuration.
- Select attack vector: dependency confusion, typosquatting, build hook injection, CI/CD tampering, or container supply chain.
- Prepare a safe proof-of-concept package with DNS canary or HTTP callback -- no destructive payload.
- Register the package on the public registry or stage the artifact for injection.
- Monitor for callback to confirm execution in the target environment.
- Document the attack path, affected systems, and remediation guidance.
Dependency Confusion
Dependency confusion exploits the resolution order when an organization uses both private and public package registries. If the private registry is not configured as the exclusive source, the package manager may prefer a higher-versioned public package over the internal one.
npm Dependency Confusion
When a project references an unscoped private package and the .npmrc does not pin the registry exclusively, npm falls back to the public registry.
