https://blog.s4yhii.com/tags/dependency-confusion/ Recent content in Dependency Confusion on s4yhii's blog https://blog.s4yhii.com/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://blog.s4yhii.com/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Sun, 26 Jul 2026 08:00:00 -0500 https://blog.s4yhii.com/posts/npm-dependency-confusion-bank/ Sun, 26 Jul 2026 08:00:00 -0500 https://blog.s4yhii.com/posts/npm-dependency-confusion-bank/ <blockquote> <p>Reported through the bank&rsquo;s bug bounty program, triaged as critical, marked valid and rewarded. Every name, host and package in this post is a placeholder, so the commands here won&rsquo;t reproduce against the real target.</p> </blockquote> <hr> <p>I never sent a payload to the bank.</p> <p>I uploaded a file to a public website, went to make coffee, and by the time I came back I had code execution on their build server, root on production containers in three different clouds, and a shell on some poor developer&rsquo;s Windows laptop.</p>