offensive-supply-chain

# Offensive Supply Chain Attacks Software supply chain attacks exploit the trust relationships between developers, package registries, build systems, and deployment pipelines. You target the components and processes that organizations depend on but rarely audit with the same rigor as their own code. A single compromised dependency can propagate across thousands of downstream consumers, making supply chain the highest leverage attack surface in modern software ecosystems. This skill covers the offensive lifecycle: reconnaissance of internal package names, exploitation of registry resolution logic, build system hook abuse, CI/CD pipeline tampering, and container image supply chain attacks. Every technique maps to authorized red team engagement patterns with safe callback mechanisms. ## Quick Workflow 1. Enumerate internal package names from target artifacts (lock files, source maps, error messages, GitHub repos). 2. Identify the package ecosystem (npm, PyPI, NuGet, Maven, Go, Ruby) and registry configuration. 3. Select attack vector: dependency confusion, typosquatting, build hook injection, CI/CD tampering, or container supply chain. 4. Prepare a safe proof-of-concept package with DNS canary or HTTP callback -- no destructive payload. 5. Register the package on the public registry or stage the artifact for injection. 6. Monitor for callback to confirm execution in the target environment. 7. Document the attack path, affected systems, and remediation guidance. --- ## Depe...