Vývoj nástroje pro detekci Dependency Confusion v JavaScriptových balíčcích používaných ve frontendových řešeních

This bachelor’s thesis addresses the issue of dependency confusion attacks in the context of JavaScript packages used in web applications. The aim of the thesis is to analyze this security risk and subsequently design, implement, and validate a tool for detecting potentially risky dependencies in the frontend parts of applications. The theoretical part describes the principles of dependency confusion attacks in the context of software supply chain security, introduces the ecosystem of JavaScript packages, and discusses the possibilities of identifying dependencies from publicly available artifacts such as bundles, chunks, minified files, and source maps. The practical part focuses on the design and implementation of a custom tool that crawls the target application, extracts information about the packages in use, verifies their presence in a public registry, and evaluates their level of risk. The practical part also includes testing of the tool on synthetic scenarios and within real bug bounty programs, together with an evaluation of its benefits, limitations, and practical usability.