Dependency Takeover

A very small helper script for your dependency confusion attack which helps in checking and taking over dependency .

Note: It doesn't exploits the system, instead it should be used for generating Proof of Concept(PoC) and also you won't get blocked by npm if you use this script because no malicious payload is used in index.js.

TL;DR: Dependency Confusion

Dependency Confusion occurs when a package manager installs a malicious package from a public registry instead of the intended private package due to conflicting or ambiguous version names. This can happen when:

• Private dependencies are named the same as public ones.
• Malicious actors publish a package with a higher version number in a public registry, causing the manager to fetch the wrong package.

For more, refer to this article - https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610 by @alxbrsn

Pre-requisites :

• Should have the following packages - npm, grep
• Must be using this script on linux/unix based system

Installation and setup :

git clone https://github.com/0xaudron/dependency-takeover 
cd dependency-takeover 
chmod +x dependency-takeover.sh
export NPM_TOKEN=<NPM-TOKEN> 

Usage (with examples) :

Run the following command after installation and setting up section:

./dependency-takeover.sh <dependency-name>

Example 1 (successful takeover)

Example 2 (unsuccessful takeover)

How to get <NPM-TOKEN>

1. Sign in/Sign up at https://www.npmjs.com
2. Navigate via Click on profile avatar > Access Tokens > Generate New Token > Classic Token > Provide a Name for token , Select Publish under Select Type
3. Now copy the TOKEN and do as mentioned in Installation steps.