Skill

performing-supply-chain-attack-simulation

From asi

Simulates and detects PyPI supply chain attacks including typosquatting via Levenshtein distance, dependency confusion against private registries, pip package hash verification, and pip-audit vulnerability scanning.

Python

security

npx claudepluginhub plurigrid/asi --plugin asi

Tool Access

This skill uses the workspace's default tool permissions.

Preview

Software supply chain attacks exploit trust in package registries through typosquatting (registering names similar to popular packages), dependency confusion (publishing higher-version public packages matching private names), and compromised package distribution. This skill detects these attack vectors by computing Levenshtein distance between package names and popular PyPI packages, verifying ...

SKILL.md

Similar Skills

performing-supply-chain-attack-simulation

5.9k

Simulates and detects Python supply chain attacks: typosquatting via Levenshtein distance, dependency confusion, pip hash verification, and pip-audit vulnerability scanning. For security audits.

3 files

cybersecurity-skills

performing-supply-chain-attack-simulation

Detects PyPI supply chain attacks including typosquatting via Levenshtein distance, dependency confusion for private registries, pip SHA-256 hash verification, and pip-audit CVE scanning. Outputs JSON risk reports.

3 files

cybersecurity-skills-zh

detecting-typosquatting-packages-in-npm-pypi

Detects typosquatting in npm and PyPI packages using Levenshtein distance, publish date heuristics, and download anomalies via registry APIs. Useful for auditing dependencies and supply chain threat hunting.

asi

Stats

Parent Repo Stars16

Parent Repo Forks5

Last CommitApr 4, 2026

Actions

View Source View Plugin View on GitHub View README

Help us improve

Share bugs, ideas, or general feedback.

Performing Supply Chain Attack Simulation

Overview

When to Use

When conducting security assessments that involve performing supply chain attack simulation

When following incident response procedures for related security events

When performing scheduled security testing or auditing activities

When validating security controls through hands-on testing

Prerequisites

Python 3.9+ with pip-audit, Levenshtein, requests

Access to PyPI JSON API (https://pypi.org/pypi/{package}/json)

Network access for package metadata retrieval

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Key Detection Areas

Typosquatting — compare package names against top PyPI packages using edit distance thresholds

Dependency confusion — check if internal package names exist on public PyPI with higher version numbers

Hash verification — download packages and verify SHA-256 digests match published hashes

Vulnerability scanning — audit installed packages against OSV and PyPA advisory databases

Metadata anomalies — flag packages with suspicious author emails, missing homepages, or very recent first upload dates

Output

JSON report with risk scores per package, detected attack vectors, hash verification results, and CVE findings.