supply-chain-attacker

name	supply-chain-attacker
description	Software supply chain attack testing — dependency confusion, typosquatting, malicious packages, CI/CD pipeline exploitation. Use when assessing supply chain security, testing package managers, or finding supply chain vulnerabilities.
domain	cybersecurity
author	oyi77
license	Apache-2.0
subdomain	general-cybersecurity
tags	["attacker","chain","cicd","cybersecurity","dependency","money","pipeline","sbom","supply","testing","threat-defense"]
version	1.0.0

Supply Chain Attacker

Overview

Software supply chain attacks exploit the trust relationships between your code and its dependencies — compromised packages, typosquatted libraries, dependency confusion, poisoned CI/CD pipelines, and tampered build artifacts. You audit lockfiles, scan container images, generate SBOMs, detect misconfigured CI/CD pipelines, and validate package integrity with Kali tools. Each engagement surfaces concrete attack paths an adversary would use to pivot through your client's dependency graph into production.

Note: On this Kali system, syft is at /tmp/bin/syft — alias it or reference the full path. trivy, pip-audit, and npm are installed and ready.

When to Use

Trigger phrases:

• "supply chain attacker"

• "Testing dependency management security"

• "Assessing CI/CD pipeline security"

• "Finding dependency confusion vulnerabilities"

• "Supply chain risk assessment"

• "SBOM generation and compliance"

• Testing dependency management security

• Assessing CI/CD pipeline security

• Finding dependency confusion vulnerabilities

• Testing package publishing processes

• Evaluating third-party risk

• SBOM generation for compliance (EO 14028, NTIA minimum elements)

• CI/CD pipeline configuration audit

• Pre-M&A technical due diligence on target's software supply chain

When NOT to Use

• When you lack proper authorization for testing (written scope required)
• For production CI/CD systems without change management / rollback plan
• When the task requires legal or compliance expertise beyond technical scope (consult a lawyer for vendor contract review)
• When the target has no package manager or dependency tree — a blank repo generates a blank report, not a billable engagement

Prerequisites

• Target project directory with lockfiles (package-lock.json, yarn.lock, poetry.lock, requirements.txt, go.sum, Cargo.lock, Gemfile.lock)
• trivy installed (brew install trivy or apt install trivy)
• syft installed (or use /tmp/bin/syft on this system)
• pip-audit installed (pip install pip-audit)
• npm with audit capability (bundled with Node.js)
• Access to client's CI/CD pipeline config (.github/workflows/, .gitlab-ci.yml, Jenkinsfile, Dockerfile)
• Written authorization for dependency tree analysis and access to source repositories
• Internet access for vulnerability database lookups

Money-Making Overview

Target Buyer

SaaS companies preparing for SOC 2 / ISO 27001 audits, DevOps teams hardening CI/CD pipelines, compliance officers needing SBOM artifacts, and startup CTOs doing pre-launch security review. Regulated industries (fintech, healthtech, critical infrastructure) are the highest-value leads.

How You Make Money

1. Supply Chain Risk Assessment — Scan dependency trees, generate SBOMs, identify known vulnerabilities (CVEs), detect dependency confusion risks, and produce a prioritized fix roadmap.
2. CI/CD Pipeline Security Audit — Review GitHub Actions, GitLab CI, Jenkins, and Docker build pipelines for compromised actions, credential leaks, script injection, and artifact tampering risks.
3. Compliance SBOM-as-a-Service — Generate CycloneDX/SPDX SBOMs for clients who need them for EO 14028, NTIA, or FDA pre-market submission compliance. Hosted plus monthly refresh retainer.

Service Tiers

Tier	Scope	Price	Delivery
Basic — Dependency Scan	Single project, trivy+syft+pip-audit+npm audit, CVE report with fix recommendations	$1,000	3 days
Pro — Full Supply Chain Audit	3 projects, dependency confusion testing, typosquatting scan, CI/CD pipeline review, SBOM in CycloneDX+SPDX, prioritized fix roadmap	$2,500	7 days
Enterprise — Continuous Compliance	Up to 10 repos, monthly SBOM refresh, CI/CD integration with automated scanning gates, Slack alerts on new CVEs, retest after fixes, quarterly review call	$4,500/mo	Ongoing

Upsells: Dependency confusion penetration test (+$1,500). CI/CD pipeline hardening workshop (+$2,000). Emergency zero-day impact assessment (+$800 flat).

Expected First Dollar Timeline

Target 3-5 local SaaS companies or DevOps agencies via cold email/LinkedIn → offer a free 30-minute "supply chain health check" → convert 1 in 5 to a paid Basic scan → first payment within 7-14 days.

Workflow

1. Repository Recon — Clone target repo(s). Inventory all package manager manifests (package.json, requirements.txt, go.mod, Cargo.toml, Gemfile, pom.xml, build.gradle). Count total dependencies.
2. SBOM Generation — Run syft on the project directory to produce CycloneDX and SPDX SBOMs. Verify SBOM covers all transitive dependencies.
3. Vulnerability Scan — Scan SBOM with trivy. Cross-reference findings against OSV.dev, NVD, and GitHub Advisory Database. Flag reachable vs. unreachable CVEs.
4. Dependency Confusion Test — For each private/internal package name, query public registries (npm, PyPI, RubyGems) to check if the name is available — if it is, an attacker could publish a malicious version and your client's build would install it.
5. Typosquatting Scan — Generate typosquatted variants of each dependency name using Levenshtein distance and check public registries for squatting packages with similar names.
6. CI/CD Pipeline Audit — Review CI config for: pinned action versions vs. @main / @v1 (floating tags), exposed secrets in workflow files, shell script injection via ${{ github.event.issue.title }}, untrusted artifact publishing, and missing code signing.
7. Reporting — Deliver per-finding with CVE reference, severity, dependency path, and exact fix command (e.g., npm audit fix, pip install --upgrade). Attach SBOM files as machine-readable artifacts.

Tools

• trivy — Comprehensive vulnerability scanner (OS packages, language deps, IaC misconfigs, SBOM scanning)
• syft — SBOM generation in CycloneDX, SPDX, Syft formats
• pip-audit — Python dependency vulnerability scanner
• npm audit — Node.js dependency vulnerability scanner
• OSV.dev / GHSA — Open-source vulnerability lookup APIs
• pip-confusion-check — Custom script (see First Action) for dependency confusion testing
• Docker Scout — Container image SBOM and vulnerability analysis
• git + gh CLI — Repository cloning and CI/CD config extraction
• jq — JSON report assembly

Process

1. Reconnaissance — Clone target repo, enumerate all package manifests, identify private packages, extract CI/CD pipeline configs. Map dependency graph size and depth.
2. SBOM + Vulnerability Scan — Run syft + trivy to generate SBOM and identify known CVEs. Prioritize by reachability and exploitability (EPSS score).
3. Dependency Confusion + Typosquatting — Check each private package name against public registries. Scan for lookalike package names with edit-distance ≤ 2.
4. CI/CD Pipeline Review — Audit GitHub Actions / GitLab CI / Jenkins for: unpinned actions, script injection vectors, credential exposure, artifact integrity gaps.
5. Fix Roadmap — For each finding: affected package, current version, fixed version, severity, CVSS score, EPSS percentile, exact upgrade command, and test impact notes.
6. Report Generation — Combine findings into a single report JSON + markdown executive summary. Attach SBOM (CycloneDX JSON + SPDX JSON) as machine-readable deliverables.

First Action in 60 Minutes

Run this script against any project directory to get an instant supply chain risk assessment — SBOM, CVE scan, dependency confusion check, and CI/CD pipeline audit in one pass.

#!/bin/bash
set -euo pipefail

# supply_chain_quick_scan.sh — 60-minute supply chain risk assessment
# Usage: ./supply_chain_quick_scan.sh /path/to/project
# Output: supply_chain_report_<project>.json + SBOM and logs in ./sc_results/

PROJECT_DIR="${1:-.}"
PROJECT_NAME=$(basename "$(realpath "$PROJECT_DIR")")
OUT_DIR="./sc_results"
mkdir -p "$OUT_DIR"

REPORT_FILE="$OUT_DIR/supply_chain_report_${PROJECT_NAME}.json"
SYFT_SBOM="$OUT_DIR/${PROJECT_NAME}_cyclonedx.json"
TRIVY_RESULTS="$OUT_DIR/${PROJECT_NAME}_trivy.json"
PIP_AUDIT_OUT="$OUT_DIR/${PROJECT_NAME}_pip_audit.json"
NPM_AUDIT_OUT="$OUT_DIR/${PROJECT_NAME}_npm_audit.json"
CONFUSION_OUT="$OUT_DIR/${PROJECT_NAME}_confusion_check.json"
CICD_FINDINGS="$OUT_DIR/${PROJECT_NAME}_cicd_findings.json"

TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
SYFT_BIN="${SYFT_BIN:-/tmp/bin/syft}"

echo "========================================"
echo "  Supply Chain Quick Scan — $PROJECT_NAME"
echo 
 

all_findings=( )
report_sections=( )


 
 
  -v  &>/dev/null ||  -v syft &>/dev/null; 
    syft_cmd=
      -o cyclonedx-json= 2>/dev/null
    dep_count=$(jq   2>/dev/null ||  0)
     
    report_sections+=()

     
    report_sections+=()



 
 
  -v trivy &>/dev/null; 
    trivy fs  \
        --format json \
        --output  \
        --severity CRITICAL,HIGH,MEDIUM \
        --ignore-unfixed \
        2>/dev/null || 

    vuln_count=$(jq   2>/dev/null ||  0)
    critical=$(jq   2>/dev/null ||  0)
    high=$(jq   2>/dev/null ||  0)

     
    report_sections+=()

    
     [  -gt 0 ]; 
        jq -c   2>/dev/null |   -r v; 
             
        
    

     
    report_sections+=()



 
 
 [ -f  ] || [ -f  ] || [ -f  ] || [ -f  ] || [ -f  ] || [ -f  ]; 
      -v pip-audit &>/dev/null; 
        pip-audit \
            -r  2>/dev/null \
            |   \
            |  -50 || 
        py_vuln_count=$(grep -c   2>/dev/null ||  0)
         
        report_sections+=()
    
         
        report_sections+=()
    

     
    report_sections+=()



 
 
 [ -f  ] || [ -f  ]; 
      -v npm &>/dev/null; 
          >/dev/null
        npm audit --json 2>/dev/null >  || 
         >/dev/null
        npm_vulns=$(jq   2>/dev/null ||  )
        npm_total=$(jq   2>/dev/null ||  0)
         
        report_sections+=()
    
         
        report_sections+=()
    

     
    report_sections+=()



 
 
confusion_findings=()


 [ -f  ]; 
    jq -r   2>/dev/null |   -r pkg; 
        
        status_code=$(curl -s -o /dev/null -w   2>/dev/null ||  )
         [  =  ]; 
             
        
    

report_sections+=()

 
 
 
 


jq -n \
    --arg project  \
    --arg timestamp  \
    --argjson sections  \
     > 

 
 
 
 
 
 
 -lh  2>/dev/null | awk 
 
 

Run it:

chmod +x supply_chain_quick_scan.sh
./supply_chain_quick_scan.sh /path/to/client-project

Deliverable Format

Send the client an invoice-ready report. Structure:

# Supply Chain Risk Assessment — <Client Name>
**Engagement:** <Basic | Pro | Enterprise>
**Date:** <YYYY-MM-DD>
**Tester:** <Your Name / Company>

## Executive Summary

<3-paragraph overview: total dependencies scanned, critical/high CVE count,
dependency confusion risks found, CI/CD pipeline gaps, overall risk rating>

## Scope

- Repository: <url or path>
- Language ecosystems: <Python, Node.js, Go, Rust, Java, Ruby>
- Total dependencies (direct + transitive): <N>
- CI/CD platforms reviewed: <GitHub Actions / GitLab CI / Jenkins>
- Container images scanned: <N>

## SBOM Artifacts

| Format | File |
|--------|------|
| CycloneDX JSON | `<project>_cyclonedx.json` |
| SPDX JSON | `<project>_spdx.json` |

*Attached as machine-readable artifacts for compliance/SBOM ingestion.*

## Vulnerability Summary

| Severity | Count | Top CVEs |
|----------|-------|----------|
| Critical |  |  |
| High |  |  |
| Medium |  | <...> |
| Low |  | <...> |



| CVE | Package | Installed | Fixed | CVSS | EPSS | Reachable? |
|-----|---------|-----------|-------|------|------|------------|
| CVE-2024-XXXX | lodash | 4.17.20 | 4.17.21 | 9.1 | 0.95 | Yes — import in src/auth.js |
| ... | ... | ... | ... | ... | ... | ... |



| Private Package | Public Registry | Available? | Risk |
|-----------------|-----------------|------------|------|
|  | npm | Yes |  — attacker can publish malicious version |
|  | PyPI | No | Low — name confirmed occupied by legitimate package |



| Legitimate Package | Squatting Package | Distance | Registry |
|--------------------|-------------------|----------|----------|
|  |  | 1 | PyPI |
|  |  | 1 | npm |



| Finding | Severity | Location | Impact |
|---------|----------|----------|--------|
| Action uses floating tag  | HIGH |  | Supply chain compromise — tag can be force-pushed |
| Hardcoded AWS secret in workflow | CRITICAL |  | Anyone with repo read can extract credentials |
| No artifact signing | MEDIUM |  | Tampered build artifacts undetectable |
| Shell injection vector in issue title | HIGH |  | PR with malicious title executes arbitrary code |



| Priority | Finding | Fix Command / Action | Effort |
|----------|---------|---------------------|--------|
| P0 | CVE-2024-XXXX in lodash |  | 5 min |
| P0 | Hardcoded AWS secret in workflow | Rotate key, use GitHub Secrets | 15 min |
| P1 | Unpinned action tag  | Pin to  | 10 min |
| P1 | Private package available on npm | Scoped package ownership verification | 1-2 days |
| P2 | No SBOM in build artifacts | Add  step to CI pipeline | 30 min |
| P2 | No vulnerability scanning in CI | Add  to pre-merge check | 30 min |



 trivy 0.71.2 — Vulnerability scanning
 syft 1.46.0 — SBOM generation (CycloneDX + SPDX)
 pip-audit 2.10.1 — Python dependency audit
 npm audit 10.9.8 — Node.js dependency audit
 supplyquick

Verification

• SBOM generated in both CycloneDX JSON and SPDX formats with complete dependency tree
• All direct and transitive dependencies scanned with trivy
• Critical and high CVEs identified with reachability analysis
• Dependency confusion risk tested on every private package name
• Typosquatting scan run with edit-distance ≤ 2 threshold
• CI/CD pipeline configs reviewed: action pinning, secrets exposure, script injection, artifact signing
• npm audit and pip-audit run where applicable
• Fix commands provided for every vulnerability (exact npm install, pip install, etc.)
• SBOM artifacts attached as machine-readable files (not just printed in report)
• Recommendations prioritized by effort vs. risk reduction
• Invoice attached

Anti-Rationalization Table

Rationalization	Reality
"We pin all our dependencies"	Pinning to a version that itself has a critical CVE is still vulnerable. You also need scanning, not just pinning.
"Our CI/CD is secure — only admins can merge"	The 2024 SolarWinds-style attack compromised the build server itself, not the merge queue. Pipeline config drift is invisible until something deploys cryptominers to production.
"We use open source, that's battle-tested"	Open source is battle-tested by attackers too. The event-stream incident (a malicious package with 2M weekly downloads) injected a bitcoin stealer into copay wallets. Popularity ≠ security.
"We have a small team, we don't need this"	Automated supply chain attacks don't care about team size. A typosquatted package or dependency confusion attack takes 15 minutes to exploit and 3 weeks to detect.
"We already use Dependabot"	Dependabot only alerts on known CVEs in direct dependencies. It misses: dependency confusion, typosquatting, CI/CD script injection, artifact tampering, and transitive vulnerabilities blocked by reachability.
"We don't use open source packages"	You use a compiler, a language runtime, a CI/CD platform, and an operating system. Every one of those is a supply chain.
"SBOM is just extra paperwork"	The FDA now requires SBOMs for medical device software pre-market submission. Your SaaS clients' enterprise customers will start demanding it in procurement RFPs this year. Make SBOMs sellable, not a checkbox.
"I need to be a certified DevSecOps engineer to charge for this"	You need to run three commands (syft, trivy, npm audit) and explain the output. Certs are nice. The report that finds an exploitable CVE in production is nicer.