offensive-dependency-confusion

# Offensive Dependency Confusion and Namespace Attacks Dependency confusion exploits a fundamental design tension in package managers: the need to resolve packages from multiple sources. When an organization maintains internal packages alongside public dependencies, the resolution logic becomes an attack surface. You exploit the gap between how developers intend packages to resolve and how package managers actually resolve them. Alex Birsan's 2021 research demonstrated that this class of attack affected Apple, Microsoft, PayPal, Shopify, Netflix, Yelp, Tesla, and Uber, among others. The root cause -- preferring a higher-versioned public package over a lower-versioned private one -- remains exploitable wherever registry configuration is incomplete. This skill provides ecosystem-specific exploitation techniques, safe PoC methodology, and comprehensive reconnaissance approaches for discovering internal package names during authorized engagements. ## Quick Workflow 1. Perform reconnaissance to discover internal/private package names used by the target. 2. Identify the target's package ecosystems and registry configuration. 3. Verify that candidate package names are unclaimed on the corresponding public registry. 4. Prepare a safe PoC package with a DNS canary or HTTP callback and a high version number. 5. Publish the PoC to the public registry with a clear security research description. 6. Monitor the callback endpoint for execution confirmations from target infrastructure. ...