Dependency Scanning: npm audit, Snyk, Supply Chain
How to scan dependencies for known CVEs, what npm audit reports mean, and how to build vulnerability scanning into your CI pipeline.
Published:
Tags: security, devops, dependencies
Dependency Vulnerability Scanning: npm audit, Snyk, and Dependabot Modern applications have thousands of dependencies. A typical Node.js application directly depends on perhaps 30-50 packages, but transitively depends on hundreds or thousands. Each of these is a potential attack surface. The Log4Shell vulnerability (Log4j, December 2021) affected millions of applications through a transitive dependency. Supply chain security starts with knowing what is in your dependency tree and whether any of it has known vulnerabilities. The Scale of the Problem A vulnerability in any transitive dependency — a package that one of your packages depends on — is a vulnerability in your application: You cannot review thousands of dependencies manually. Automated scanning is the only practical approach. npm…
All articles · theproductguy.in