Lion Cipher Lab
Hijack a build with dependency confusion: publish a higher-versioned twin of an internal package, run code at install time — then close the hole four ways
- AppSec / DevSecOps
- Advanced
- ~90 min
- Free · no account required
Why it matters
In 2021 a researcher named Alex Birsan got code to run inside the build systems of Apple, Microsoft, PayPal and dozens of other companies without phishing anyone or finding a single memory-corruption bug. He did it by noticing that big companies reference INTERNAL packages by name in their manifests — names like `acme-auth-helpers` that live only on a private registry — and that package managers, when they see a name they can fetch from more than one place, tend to grab the HIGHEST version number, wherever it lives. So he published packages with those exact internal names, and absurdly high…
What you'll learn
- reproducing a dependency-confusion / package-substitution attack end to end on localhost
- understanding how npm resolves a bare package name across multiple registries and picks the highest SemVer version
- weaponising an install lifecycle script (preinstall) as the code-execution primitive
- hardening a build with scoped packages + per-scope registry pinning in .npmrc
- locking installs down with a committed package-lock.json and `npm ci`, disabled install scripts, and defensive name registration
Steps in this lab
- Why a build is the perfect place to attack — and what 'confusion' means
- Install Verdaccio and stand up TWO local registries
- Publish the genuine internal package to the private registry
- Build the victim app and prove the clean install works
- Attack: publish the higher-versioned evil twin to the PUBLIC registry
- Fire it: the victim's install pulls YOUR package and runs YOUR code
- Why it worked — the two design facts you must internalise
- Fix #1 (the real fix): scope the package and pin the scope to the internal registry
- Fix #2: freeze versions and sources with a committed lockfile and `npm ci`
- Fix #3 and #4: blunt the primitive, and register the names defensively
- What you can now spot in the wild