Dependency Audit

Dependency Audit

What This Does

Audits application dependencies for known vulnerabilities (CVEs), license compliance issues, and supply chain risks. Covers npm, pip, cargo, and other package managers. Produces a prioritized remediation plan and recommends ongoing monitoring setup.

Instructions

1. Identify all dependency sources. Check for:

   • package.json / package-lock.json (npm/Node.js)
   • requirements.txt / Pipfile / pyproject.toml (Python)
   • Cargo.toml / Cargo.lock (Rust)
   • go.mod / go.sum (Go)
   • Gemfile / Gemfile.lock (Ruby)
   • pom.xml / build.gradle (Java/Kotlin)
   • Docker base images
   • CDN-loaded scripts (often missed)

2. Run automated vulnerability scans.

   # npm
   npm audit
   npm audit --json > audit-report.json
   
   # pip
   pip-audit
   pip-audit --format json > audit-report.json
   
   # cargo
   cargo audit
   
   # Snyk (cross-platform)
   snyk test --json > snyk-report.json
   
   # GitHub (if repo is on GitHub)
   gh api repos/{owner}/{repo}/vulnerability-alerts
   

3. Analyze the vulnerability report. For each finding:

   • CVE ID and severity (CVSS score)
   • Affected package and version range
   • Fix available? If yes, what version?
   • Is the vulnerable code path actually used? (reachability analysis)
   • Transitive or direct dependency? Direct dependencies are easier to update

4. Check for supply chain risks. Beyond known CVEs:

   • Maintainer count: Single-maintainer packages are higher risk
   • Last published: Packages not updated in 2+ years may be abandoned
   • Download count: Very low downloads may indicate an untested package
   • Typosquatting: Check for similarly-named packages that might be malicious
   • Install scripts: Check for suspicious postinstall scripts
   • Dependency count: Packages with many transitive dependencies expand attack surface

5. Check license compliance. For each dependency:

   • Identify the license (MIT, Apache-2.0, GPL, etc.)
   • Flag copyleft licenses (GPL, AGPL) if the project is proprietary
   • Flag licenses with patent clauses if relevant
   • Check for "license: UNLICENSED" or missing license fields

   # npm license checker
   npx license-checker --summary
   npx license-checker --failOn "GPL-3.0;AGPL-3.0"
   

6. Create the remediation plan. Prioritize by:

   1. CRITICAL/HIGH CVEs with known exploits — fix immediately
   2. CRITICAL/HIGH CVEs without known exploits — fix this sprint
   3. MEDIUM CVEs — schedule for next cycle
   4. License violations — assess and address
   5. Supply chain risks — evaluate and mitigate

7. Set up ongoing monitoring.

   • Enable Dependabot or Renovate for automated PRs
   • Add npm audit / pip-audit to CI pipeline
   • Configure Snyk or Socket.dev for continuous monitoring
   • Set up alerts for new CVEs in your dependency tree

Output Format

# Dependency Audit Report: {Project}
**Date:** {YYYY-MM-DD}
**Package manager:** {npm/pip/cargo/etc.}
**Total dependencies:** {count direct} direct, {count transitive} transitive

## Vulnerability Summary
| Severity | Count | Fixable |
|----------|-------|---------|
| Critical | {n} | {n} |
| High | {n} | {n} |
| Medium | {n} | {n} |
| Low | {n} | {n} |

## Critical Findings

### CVE-{id}: {package}@{version}
- **Severity:** {CVSS score}
- **Description:** {what the vulnerability allows}
- **Fix:** Update to {package}@{fixed-version}
- **Reachable:** {Yes/No — is the vulnerable code path used?}
- **Command:** `npm install {package}@{fixed-version}`

## Supply Chain Risks
| Package | Risk | Details |
|---------|------|---------|
| {package} | {risk type} | {description} |

## License Summary
| License | Count | Compliance |
|---------|-------|------------|
| MIT | {n} | OK |
| Apache-2.0 | {n} | OK |
| GPL-3.0 | {n} | REVIEW |

## Remediation Plan
1. [ ] {Highest priority fix}
2. [ ] {Next priority fix}
...

## Monitoring Setup
{Recommended tools and CI configuration}

Tips

• npm audit often reports vulnerabilities in dev dependencies — prioritize production dependencies first
• A vulnerability in a transitive dependency may not be exploitable if the parent doesn't use the affected API
• Dependabot PRs can pile up — batch minor/patch updates with Renovate's grouping feature
• Socket.dev specifically detects supply chain attacks (install scripts, network calls, etc.) — use it for npm
• Lock files (package-lock.json, Cargo.lock) are critical for reproducible builds — always commit them
• Check base Docker images too — they often contain more vulnerabilities than your application code