DepConfuse

Overview

DepConfuse is a command-line tool that proactively detects dependency confusion vulnerabilities. It scans SBOMs or PURLs to identify internal package names that could be subject to public package takeover, providing actionable insights to secure your software supply chain.

✨ Key Features

• SBOM-First Approach: Built on CycloneDX SBOMs, DepConfuse detects dependency confusion risks across ecosystems, offering broader and more precise coverage than tools limited to individual package managers.
• Multi-Registry Support: Supports 20+ package registries. It covers npm, PyPI, Maven, NuGet, Docker Hub, Go modules, Ruby gems and more.
• PURL Analysis: Directly analyzes a list of Package URLs (PURLs) from a text file.
• Flexible Input Modes: Accepts both CycloneDX SBOMs (--sbom) and plain PURL lists (--file).
• Ecosystems.ms Integration: Provides real-time, namespace-aware checks across multiple ecosystems via a unified API.

📦 Installation

1. Clone the Repository:

   git clone https://github.com/th3-j0k3r/DepConfuse.git

2. Navigate to the Directory:

   cd DepConfuse

3. Build the Executable:

   go build -o depconfuse

🔧 Usage

DepConfuse can be used in two modes:

1. SBOM Analysis Mode

./depconfuse --sbom /path/to/sbom.json --output results.txt

2. PURL File Analysis Mode

./depconfuse --file /path/to/purls.txt --output results.txt

🤝 Credits

This project uses the following open-source projects:

• CycloneDX
• Package URL (PURL)
• Echosyste.ms
• Alex Birsan dependency confusion research