Auditing Dependencies

Auditing Dependencies

Goal

Maintain a "clean room" environment where every external package is verified, pinned, and free of known vulnerabilities (CVEs) or malicious maintainer practices.

When to Use

• When adding a new dependency.
• During weekly maintenance cycles.
• When a security alert is published for the tech stack.

Instructions

1. Scan for Known Vulnerabilities

Use ecosystem-specific tools to check against CVE databases.

• Node/JS: npm audit or pnpm audit.
• Python: pip-audit or safety.
• General: GitHub Dependabot alerts (if available).

2. Verify Package Health (Supply Chain Hygiene)

Before installing a package, check:

• Maintenance: Last commit date < 6 months ago?
• Popularity/Community: Stars, downloads, and active issues.
• Maintainer Reputation: Is it a solo dev with no history, or a recognized organization?
• Typosquatting: Double-check the spelling (e.g., react vs raect).

3. Pin Versions

Never use loose version ranges in production.

• Good: "react": "18.2.0" (Exact version)
• Bad: "react": "^18.2.0" (Allows updates that might introduce bugs or malware)
• Lockfiles: Ensure package-lock.json, pnpm-lock.yaml, or poetry.lock is committed.

4. Minimize Dependency Tree

• Do we need a 5MB library for a function we can write in 10 lines?
• "Tree-shaking" only helps bundle size; it doesn't prevent install-time scripts from running.

Constraints

✅ Do

• Use a Software Bill of Materials (SBOM) approach: know exactly what is running.
• Audit dev dependencies too; they run on developer machines and CI servers.
• Automate dependency scanning in the CI/CD pipeline.
• Remove unused dependencies immediately.

❌ Don't

• DO NOT ignore "moderate" severity alerts if they are easy to exploit.
• DO NOT install packages from unverified registries.
• DO NOT blind-update all packages without testing.

Output Format

• Update package.json / requirements.txt with pinned versions.
• AUDIT_LOG.md entry confirming the check.

Dependencies

• shared/environment-config/SKILL.md