Payloads · Misconfiguration and Insecure Design
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky. The repository.
3 of 3 passages
> A dependency confusion attack or supply chain substitution attack occurs when a software installer script is tricked into pulling a malicious code file from a public repository instead of the intended file of the same name from an internal repository.
Look for `npm`, `pip`, `gem` packages, the methodology is the same : you register a public package with the same name of private one used by the company and then you wait for it to be used. * **DockerHub**: Dockerfile image * **JavaScript** (npm): package.json * **MVN** (maven): pom.xml * **PHP** (composer): composer.json * **Python** (pypi): requirements.txt
* List all the packages (ie: package.json, composer.json, ...) * Find the package missing from [www.npmjs.com](https://www.npmjs.com/) * Register and create a **public** package with the same name * Package example : [0xsapra/dependency-confusion-expoit](https://github.com/0xsapra/dependency-confusion-expoit)
Data as of 2026-11-14.