Dependency and Supply-Chain Review
Use current primary guidance as a review baseline, then report only what the available evidence supports. Primary authority: official reference.
Workflow
- Inventory direct and transitive dependency sources, lockfiles, registries, build tools, CI actions, and produced artifacts.
- Check version constraints, integrity hashes, immutable pins, maintainer or publisher identity, and unexpected source changes.
- Review known-vulnerability evidence using current authoritative advisory sources when network access is authorized.
- Trace the build entry point, external downloads, generated code, credentials, and artifact signing or attestation evidence.
- Use NIST SSDF outcomes to identify process gaps and SLSA provenance concepts to describe evidence.
- Assess update, rollback, revocation, dependency confusion, typosquatting, and abandoned-package exposure.
- Prioritize findings by reachability, exploitability, privilege, and ability to reproduce the build.
Boundaries
- Do not claim a SLSA level unless independently verified against every applicable requirement.
- Do not update, install, execute, or publish dependencies during a read-only review.
- Absence from an advisory feed is not proof that a dependency is safe.
Output
Return Inventory, Provenance evidence, Findings, Reachability, Build risks, Recommended controls, and Claim limits.
1---2name: dependency-supply-chain-review3description: Review software dependencies and build supply-chain evidence for provenance, integrity, maintenance, vulnerability, and compromise risk. Use for a read-only assessment of manifests, lockfiles, registries, build inputs, CI actions, artifacts, and update policy.4license: MIT5---67# Dependency and Supply-Chain Review89Use current primary guidance as a review baseline, then report only what the available evidence supports. Primary authority: [official reference](https://slsa.dev/spec/v1.2/provenance).1011## Workflow12131. Inventory direct and transitive dependency sources, lockfiles, registries, build tools, CI actions, and produced artifacts.142. Check version constraints, integrity hashes, immutable pins, maintainer or publisher identity, and unexpected source changes.153. Review known-vulnerability evidence using current authoritative advisory sources when network access is authorized.164. Trace the build entry point, external downloads, generated code, credentials, and artifact signing or attestation evidence.175. Use NIST SSDF outcomes to identify process gaps and SLSA provenance concepts to describe evidence.186. Assess update, rollback, revocation, dependency confusion, typosquatting, and abandoned-package exposure.197. Prioritize findings by reachability, exploitability, privilege, and ability to reproduce the build.2021## Boundaries2223- Do not claim a SLSA level unless independently verified against every applicable requirement.24- Do not update, install, execute, or publish dependencies during a read-only review.25- Absence from an advisory feed is not proof that a dependency is safe.2627## Output2829Return Inventory, Provenance evidence, Findings, Reachability, Build risks, Recommended controls, and Claim limits.
JovaniPink