supply-chain-overview

# Supply Chain Operator Skill Catalog Supply-chain attacks have grown 1,300% since 2020 per Decepticon's own [ai-red-teaming.md](../../red-team/tools-techniques.md). This catalog gives the agent the playbooks to simulate the most common patterns — all in a sandbox-isolated mode that publishes to a local mock registry by default and to a real one only with `supply_chain_real_publish=true` in ConOps. ## Playbooks > **Inline technique reference — not separately loadable skills.** The entries below > are summarized here for direct use; there is no separate `SKILL.md` to open for > each. Do NOT call the skill loader on them — apply the technique with your tools > using this summary and the Workflow in this file. | Technique | Use for | |---|---| | **typo-name-gen** | Generate typosquat candidates for a target package; reachability + popularity score | | **dep-confusion-probe** | Check whether an internal package name is squat-able on PyPI / NPM / RubyGems / NuGet | | **post-install-script** | Author + sandboxed publish of a benign post-install probe | | **gh-actions-fork-pr** | Fork-PR secret mining; `pull_request_target` misconfiguration scan | | **oauth-app-impersonation** | Lookalike OAuth app + scope-creep social engineering | | **internal-mirror-poison** | Verdaccio / Artifactory / Nexus index manipulation | | **sbom-divergence** | Audit SBOM vs actual installed packages for drift | | **vendor-portal-creds** | SaaS vendor admin portal credential abuse paths | ## Dry-run mode All publish-mode skills accept a `--dry-run` flag that: 1. Generates the typosquat package contents in `/workspace/typo-pkg/`. 2. Builds the artifact (`.tar.gz`, `.tgz`, etc.) without uploading. 3. Computes the "hit probability" via the target package's historical download counts + Levenshtein distance. 4. Reports the artifact location + hit probability for human review. Real publish requires both `supply_chain_real_publish=true` in ConOps AND operator HITL approval at the moment of publish. Defense in depth. ## GitHub Actions attack surface Most rewarding attack class in 2024-2026. Common misconfigurations: - `pull_request_target` with `actions/checkout` of `${{ github.event.pull_request.head.sha }}` → fork PRs run with target-repo secrets. - `workflow_run` triggers reading `inputs` without sanitization. - `${{ github.event.pull_request.title }}` interpolated into shell. - Shared `GITHUB_TOKEN` with write scope on `contents`. The `gh-actions-fork-pr` skill encodes the full enumeration: search the target org's workflows, identify exploitable patterns, build a PoC fork PR that exfiltrates `secrets.*` without modifying the workflow file itself (so the operator's PR doesn't look obviously malicious to a human reviewer). ## Detection emission For every simulated attack, the Detector agent produces: - A Sigma rule for the SIEM (e.g., unusual `npm install` in CI logs, `actions/checkout@` followed by `secrets.*` reference patterns). - A GitHub Actions YAML linter rule for the customer's pre-merge checks. - A SLSA attestation gap report. ## Out of scope Real-world publication that could harm third parties (other companies who consume the customer's internal packages). The `dep-confusion-probe` explicitly avoids this by checking name availability without uploading; the operator decides whether to follow through.