Testing playbook · advanced
Dependency Confusion & Supply Chain
Discover internal package names and (with authorization) demonstrate how a public look-alike could be pulled into builds.
Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.
Every step requires authorization. Review side effects before running commands against a live system.
Harvest internal names
Scrape package.json, requirements.txt, .npmrc, lockfiles, and JS bundles for internal/private package names.
cat jsfiles.txt | jsluice urls | grep -i 'internal\|@corp'Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Check registry gaps
See whether those names are unclaimed on public npm/PyPI - an unclaimed internal name is the confusion vector.
npm view <internal-pkg> 2>/dev/null || echo unclaimedEvidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Prove impact safely
Only within scope and program rules: a benign PoC that phones home (no data exfil) demonstrates resolution without harm. Never publish malicious code.
Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.
Field notes
Common guidance
- Scoped packages (@org/pkg) with an unclaimed scope are prime candidates.
- This is high-impact and high-sensitivity - get explicit authorization first.
Related tools
Mapped workflow tools
Sources
References
Version history: normalized permanent page created 2026-08-20.