Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Supply Chain Attack - Dependency Exploitation
Mission
Analyze the dependency records of a Node.js app (`package.json`, `dependencies.txt`, `install.log`). Identify the typosquatting dependency whose name closely mimics a legitimate package, and read the flag from its `postinstall` output in `install.log`. No real install or exploitation is needed.
Hints
Hint 1 Show
One entry in dependencies.txt is a typosquat that closely mimics a legitimate package name
Hint 2 Show
Check install.log for that package's postinstall script output
Hint 3 Show
The obfuscated postinstall log reveals the flag