Dependency confusion using Burp Collaborator callbacks

SafeDep: multiple npm packages impersonating popular names, including
activity that used Burp Collaborator for dependency-confusion callbacks.
Public registry name collision is the SSC issue either way.

Mapped techniques

T0120 Dependency confusion
T0109 Publish malicious artifact

supply-chain campaign

T0120 · Initial Access · Dependency confusion

Name collision packages.

T0109 · Resource Development · Publish malicious artifact

Published to public npm.

Sources

https://safedep.io/burp-collaborator-for-dependency-confusion-attack