# Dependency Confusion

Supply-chain testing via package-manager dependency confusion: when internal package...

- Repository: https://github.com/yaklang/hack-skills (2601 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-09-13
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add yaklang/hack-skills --skill dependency-confusion -g -a claude-code -y`
Codex: `npx skills add yaklang/hack-skills --skill dependency-confusion -g -a codex -y`
Cursor: `npx skills add yaklang/hack-skills --skill dependency-confusion -g -a cursor -y`
Gemini CLI: `npx skills add yaklang/hack-skills --skill dependency-confusion -g -a gemini-cli -y`

## Description

Supply-chain testing via package-manager dependency confusion: when internal package names resolve to attacker-controlled public registries, leading to malicious install and script execution. Use for npm/pip/gem/Maven/Composer/Docker manifest review and authorized red-team supply-chain exercises.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# SKILL: Dependency Confusion, Supply Chain Attack Playbook

> **AI LOAD INSTRUCTION**: Expert dependency-confusion methodology. Covers how private package names leak, how public registries can win version resolution, ecosystem-specific pitfalls (npm scopes, pip extra indexes, Maven repo order), recon commands, non-destructive PoC patterns (callbacks, not data exfil), and defensive controls. Pair with supply-chain recon workflows when manifests or CI caches are in scope. **Only use on systems and programs you are authorized to test.**

## 0. QUICK START

**What to look for first**

- **Manifests** listing package names that look **internal** (short unscoped names, org-specific tokens, product codenames) without a **hard-private registry lock**.
- Evidence the **same name** might exist, or be **squattable**, on a **public** registry with a **higher semver** than the private feed publishes.
- **Lockfiles** missing, stale, or not enforced in CI so `install`/`build` can drift toward public metadata.

**Fast mental model**: *If the resolver can see both private and public indexes, and version ranges allow it, the “newest” matching version may be the attacker’s.*

Routing note: if the task comes from supply-chain, repository exposure, or CI-build recon, first use `recon-for-sec` to list internal package names and possible public-registry collisions.

---

## 1. CORE CONCEPT

The rest: https://github.com/yaklang/hack-skills/blob/HEAD/skills/dependency-confusion/SKILL.md