<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-dependency-hijacking
description: >-
  Detect dependency hijacking attacks including typosquatting, dependency confusion,
  and account takeover of legitimate package maintainers. Identify suspicious package
  mutations, unexpected registry sources, and indicators of supply chain compromise.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - dependency-hijacking
  - typosquatting
  - dependency-confusion
  - package-takeover
  - supply-chain-attack
  - registry-security
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Detecting Dependency Hijacking

## Overview

Dependency hijacking encompasses attacks where adversaries substitute or inject
malicious packages into a software supply chain. This includes typosquatting (registering
similar package names), dependency confusion (exploiting private/public namespace
resolution), and maintainer account takeover. This skill provides detection capabilities
for identifying hijacked dependencies before they enter production builds.

Mode: `[MODE: BLUE]` — Detect and prevent dependency hijacking across package ecosystems.

## Prerequisites

| Requirement | Details |
|---|---|
| pip-audit (`pip install pip-audit`) | Required |
| npm audit / yarn audit | Required |
| socket.dev CLI (`npm install -g @socketsecurity/cli`) | Required |
| jq for JSON processing | Required |
| Python 3.10+ with `packageurl-python`, `requests` | Required |

## Key Concepts

### Typosquatting Detection

```bash
# Compare installed packages against known-good manifest
diff <(pip list --format=json | jq -r '.[].name' | sort) \
     <(jq -r '.[] | .name' known-good-packages.json | sort)

# Check npm packages for name similarity to popular packages
npx socket check-npm-package suspicious-pkg --json | jq '.issues[]'

# Detect Levenshtein-distance-1 typosquats of popular packages
pip-audit --desc --format json | jq '.dependencies[] |
  select(.vulns | length > 0) | {name: .name, vulns: .vulns}'
```

### Dependency Confusion Detection

```bash
# Identify packages resolving from unexpected registries
npm config get registry
pip config get global.index-url

# Check for internal package names existing on public registries
curl -s "https://registry.npmjs.org/internal-pkg-name" | jq '.error // "EXISTS ON PUBLIC"'

# Verify pip package source
pip install --dry-run --no-deps internal-pkg 2>&1 | grep -i "from"
```

### Maintainer Takeover Indicators

```bash
# Check npm package maintainer history
npm view lodash maintainers --json | jq '.'

# Detect recent maintainer changes on PyPI
curl -s "https://pypi.org/pypi/package-name/json" | jq '{
  author: .info.author,
  maintainer: .info.maintainer,
  last_release: (.releases | keys | last)
}'

# Flag packages with single maintainer (bus factor risk)
npm view pkg-name maintainers --json | jq 'if length == 1 then "SINGLE_MAINTAINER_RISK" else "ok" end'
```

## Workflow

### Step 1: Scan dependencies for hijacking indicators

```bash
node scripts/agent.js --action scan --manifest /tmp/target --output /tmp/scan-result.json
```

### Step 2: Compare current deps against known-good baseline

```bash
node scripts/agent.js --action compare --manifest /tmp/target --output /tmp/compare-result.json
```

### Step 3: Generate dependency hijacking risk report

```bash
node scripts/agent.js --action report --manifest /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Dependency Hijacking Detection
id: 69f0e760-6724-4c4c-aee9-47a846820831
status: experimental
description: Detects suspicious activity related to detecting dependency hijacking techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*detecting*dependency*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Dependency Hijacking Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All dependencies resolve from expected registries
- [ ] No typosquatting candidates detected within edit-distance threshold
- [ ] Package maintainer history verified — no recent suspicious transfers
- [ ] Internal package names do not collide with public registry namespaces
- [ ] Dependency lock files match expected content hashes

## References

- [Socket.dev Documentation](https://docs.socket.dev/)
- [npm Security Advisories](https://github.com/advisories)
- [PyPI Security Model](https://pypi.org/security/)
- [Dependency Confusion Research](https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610)
