What problem does it solve? Security teams struggle to systematically identify supply-chain weaknesses—dependency confusion candidates, typosquat openings, GitHub Actions injection flaws, and leaked internal package names—across a target's public footprint before attackers find them. ## Core Features & Use Cases - Dependency-Confusion Detection: Discovers internal package names in JS bundles, package.json, and requirements.txt, then checks whether those names are unclaimed on npm, PyPI, RubyGems, or Go modules. - GitHub Actions Injection Scanning: Flags pull_request_target workflows, untrusted context interpolation, mutable action tags, and self-hosted runner exposure in public repositories. - Registry & SBOM Mining: Enumerates Docker Hub/GHCR images, extracts secrets from image layers, and parses published SBOMs to map exact dependency versions against OSV/NVD known vulnerabilities. - Use Case: During an authorized external red-team engagement, point the workflow at a target's public GitHub org to produce a calibrated list of supply-chain findings—each with concrete package names, exploitability evidence, and severity ratings. ## Quick Start Run external supply-chain reconnaissance against the target's public GitHub organization and report any unclaimed internal package names, injectable workflows, and leaked registry credentials.
