Supply-Chain Exploitation — Category Overview

This is a routing skill for supply-chain attack research. Sub-skills cover specific techniques against the dependency, build, and distribution layers.

Sub-Skills

Surface Discovery

# Lockfiles often expose private package names that aren't on public registry
grep -hE '"name":|"@.+/' package-lock.json yarn.lock pnpm-lock.yaml | sort -u
# pip
grep -E '^[a-z0-9_-]+' requirements.txt
# go.mod
grep '^\s*[a-z0-9./_-]\+\s' go.mod
# Maven
grep -A1 '<artifactId>' pom.xml | grep -v '^--$'

Decision Notes

• Always confirm scope authorization in writing before publishing any package, even a benign one, to a public registry. Some bounty programs explicitly disallow public-registry submissions.
• Use a beacon-only payload (DNS callback, HTTPS GET) for confirmation; never ship code that mutates the target environment without an explicit follow-up authorization.
• Real damage from confusion attacks is usually post-install scripts (postinstall, setup.py install) — focus PoCs on benign callbacks, not RCE.
• For build-pipeline poisoning (workflow injection, branch protection bypass) see /skills/standard/exploit/ad/SKILL.md (CI-as-AD-equivalent paths) and the broader threat-modeling under /skills/shared/opsec/SKILL.md.