Supply Chain Security

OWASP A03:2025 - Software Supply Chain Failures

When NOT to Use This Skill

License compliance - Use license-compliance skill for SPDX and license auditing
Secrets in dependencies - Use secrets-management for credential issues
Application-level vulnerabilities - Use owasp-top-10 for code security
Git/GitHub operations - Use Git skills for repository management

Deep Knowledge: Use mcp__documentation__fetch_docs with technology: security for comprehensive documentation.

Key Risks

Risk	Impact	Mitigation
Vulnerable dependencies	RCE, data breach	Regular audits, auto-updates
Typosquatting	Malicious code execution	Verify package names
Compromised packages	Backdoors, malware	Lockfiles, integrity checks
CI/CD pipeline attacks	Code injection, secrets theft	Least privilege, signed commits

Dependency Auditing

Node.js

# Built-in audit
npm audit
npm audit fix
npm audit --json > audit.json

# Advanced scanning
npx snyk test
npx retire

# Auto-fix PRs
# Use Dependabot or Renovate

Python

# pip-audit
pip-audit
pip-audit --output=json

# Safety
safety check
safety check -r requirements.txt

# pip install with hash verification
pip install --require-hashes -r requirements.txt

Java

# OWASP Dependency Check
mvn dependency-check:check
./gradlew dependencyCheckAnalyze

# Snyk
snyk test --all-projects

Lockfiles

Always commit and use lockfiles:

Package Manager	Lockfile	Install Command
npm	package-lock.json	`npm ci`
yarn	yarn.lock	`yarn install --frozen-lockfile`
pnpm	pnpm-lock.yaml	`pnpm install --frozen-lockfile`
pip	requirements.txt (with hashes)	`pip install --require-hashes`
poetry	poetry.lock	`poetry install --no-root`

# npm - use ci in CI/CD
npm ci  # NOT npm install

# Verify integrity
npm audit signatures

SBOM Generation

Software Bill of Materials for transparency:

# CycloneDX format
npx @cyclonedx/cyclonedx-npm --output-file sbom.json

# SPDX format
npx spdx-sbom-generator

# Syft (multi-language)
syft . -o cyclonedx-json > sbom.json

Package Integrity

Subresource Integrity (SRI)

<script src="https://cdn.example.com/lib.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/..."
  crossorigin="anonymous">
</script>

npm package verification

# Verify signatures
npm audit signatures

# Disable postinstall scripts
npm config set ignore-scripts true

# Or per-install
npm install --ignore-scripts

CI/CD Security

GitHub Actions

# Pin actions to SHA
- uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.1.0

# Minimal permissions
permissions:
  contents: read
  packages: write

# Signed commits requirement
# Enable in repo settings: "Require signed commits"

Secrets in CI/CD

# Never echo secrets
- run: |
    # Wrong
    echo ${{ secrets.API_KEY }}

    # Right - use as env var
    env:
      API_KEY: ${{ secrets.API_KEY }}
    run: ./deploy.sh

Dependabot Configuration

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    groups:
      dev-dependencies:
        dependency-type: "development"
    ignore:
      - dependency-name: "*"
        update-types: ["version-update:semver-major"]

Security Checklist

All dependencies audited regularly
Lockfiles committed and enforced
CI/CD uses npm ci / frozen lockfile
Dependabot/Renovate enabled
SBOM generated for releases
Package signatures verified
Post-install scripts disabled in CI
GitHub Actions pinned to SHA
Minimal CI/CD permissions

Anti-Patterns

Anti-Pattern	Why It's Bad	Correct Approach
Using `npm install` in CI	Non-deterministic builds	Use `npm ci` with lockfiles
Not committing lockfiles	Inconsistent dependencies	Always commit package-lock.json
Ignoring audit warnings	Known vulnerabilities in prod	Fix or accept risk explicitly
Using wildcards in versions (^, ~)	Unexpected breaking changes	Pin exact versions for critical deps
Running postinstall scripts blindly	Malicious code execution	Use `--ignore-scripts` or audit first
No Dependabot/Renovate	Manual dependency updates	Enable automated PR creation

Quick Troubleshooting

Issue	Likely Cause	Solution
npm audit shows 100+ vulnerabilities	Transitive dependencies	Run `npm audit fix`, check for breaking changes
Lockfile conflicts in PR	Different npm versions	Use same npm version across team (in .nvmrc)
CI build fails after dependency update	Breaking change in minor version	Pin exact versions, test before merging
Package not found during install	Typosquatting or removed package	Verify package name on npmjs.com
SBOM generation fails	Missing dependencies	Run `npm ci` before generating SBOM
Dependabot PRs failing	Incompatible version	Review changelog, may need code changes

supply-chain

Supply Chain Security

When NOT to Use This Skill

Key Risks

Dependency Auditing

Node.js

Python

Java

Lockfiles

SBOM Generation

Package Integrity

Subresource Integrity (SRI)

npm package verification

CI/CD Security

GitHub Actions

Secrets in CI/CD

Dependabot Configuration

Security Checklist

Anti-Patterns

Quick Troubleshooting

Related Skills