feat(web2-vuln-classes): add dependency confusion / supply chain class

[letztek]

What

Adds a new numbered bug class 24. DEPENDENCY CONFUSION / SUPPLY CHAIN to skills/web2-vuln-classes/SKILL.md, and bumps the file title from "23 Classes" to "24 Classes".

The new class follows the existing house style (Root Cause → Detection → Variants → callback-only PoC → Real Paid Examples → Chains → Triage):

• Finding internal/private package names — leaked package.json / lockfiles on GitHub, require('@org/internal-pkg') strings scraped from public JS bundles, .npmrc / .pip.conf registry refs, error messages and 404 Not Found from internal registries, source maps.
• Confirming the name is unclaimed on the public registry (npm view, pip index, RubyGems/Maven Central checks) — the kill switch: if the name is already taken, it is N/A.
• The responsible-disclosure PoC — publish a benign placeholder that fires a DNS/HTTP callback from a preinstall/postinstall hook to prove execution. Strong, repeated emphasis on callback only, never a real payload (no reverse shell, no file read, no env exfil beyond the minimal hostname/whoami needed to prove a real corporate host fired — and only where program policy allows). Includes ARIN/source-IP analysis to rule out registry-scanner false positives.
• Per-ecosystem variants — npm (postinstall + scoped-package nuance), pip/PyPI (setup.py execution), Maven (groupId/internal repo), RubyGems (Gemfile/gemspec), with cross-language notes documented by Snyk and SystemsHardening.
• Scope caveats — many programs treat speculative dep-confusion as N/A without proof of execution; some (e.g. Facebook) reject when the internal package was never published publicly; Netflix marks shared-root-cause reports Duplicate. Only valid when the org actually resolves from the public registry AND your callback fires from their infrastructure.

This change uses standard CLI tooling only — no new MCP dependency.

Why

The skill had no supply-chain / dependency-confusion coverage despite it being a high-payout, low-dup class. Alex Birsan's original research paid $130k+ across 35 companies and the technique is still live — Microsoft Security documented 33 malicious npm packages abusing it in May 2026.

References

• Alex Birsan, "Dependency Confusion" disclosure ($130k+ across 35 companies)
• Snyk and SystemsHardening cross-ecosystem dependency-confusion guidance
• Microsoft Security reporting (May 2026) on 33 malicious npm packages abusing the technique

No dollar figures or CVEs were fabricated.

Merge order

Touches only skills/web2-vuln-classes/SKILL.md. If another in-flight PR also adds a numbered class to this file, the loser should renumber this to the next free integer and bump the "N Classes" header/frontmatter count accordingly (same convention used for prior class additions).