Supply chain security

📘What it really is

• Your app depends on hundreds of packages (look at node_modules), base images, GitHub Actions and services. Any of them can bring risk:
• known vulnerabilities in old versions;
• malicious packages: typo names (expresss), hijacked maintainer accounts, packages that steal secrets on install;
• invented packages suggested by AI tools, which attackers then register ("slopsquatting");

• compromised build tools or Actions.

• Defences:

• fewer dependencies: don't add a package for something a few lines can do; remove unused ones;
• check before adding: real, well-maintained, widely used, with a reputable maintainer and recent activity; spelling matches exactly;
• lock files committed and npm ci in CI (Module 71), so versions don't change silently;
• automated updates: Dependabot or Renovate opens pull requests for updates, which your CI tests;
• audit: npm audit, GitHub's Dependabot alerts, and container image scanning (Trivy, Docker Scout);
• disable install scripts where you can (npm ci --ignore-scripts, then run only needed ones) to limit what packages run on install;
• pin GitHub Actions to versions or commit hashes, and keep workflow permissions narrow (Module 71);
• SBOM (software bill of materials): a list of every component, so you can quickly tell whether a newly announced vulnerability affects you.
• Update regularly in small steps. A few minor updates each week are easy; two years of updates at once are painful and risky.