Dependency hygiene basics

Most supply chain risk enters through dependencies. Good hygiene is not glamorous, but it prevents a large share of problems.

Lock files, always

A lock file records the exact version and integrity hash of every dependency, including transitive ones: package-lock.json or pnpm-lock.yaml for Node.js, poetry.lock, uv.lock or hashed requirements files for Python, go.sum for Go.

• Commit lock files to the repository.
• Install from the lock file in CI: npm ci, not npm install, so builds use exactly the reviewed versions and fail if the lock file is out of date.
• Verify hashes where the tool supports it, for example pip install --require-hashes.

Choose dependencies deliberately

Before adding a package, spend five minutes checking:

• Is it actively maintained, with recent releases and responsive issues?
• How many maintainers does it have, and do they use protections such as MFA on the registry?
• Does it pull in a large tree of transitive dependencies for a small feature?
• Could a few lines of your own code replace it?

The OpenSSF Scorecard project rates open source repositories on practices such as branch protection, code review and pinned dependencies, which gives a quick signal.

Guard against confusion and typos

• Use scoped or namespaced internal packages, such as @yourcompany/utils, and configure the package manager so internal scopes resolve only from your private registry.
• Watch for look alike names when adding packages. Copy names from official documentation rather than typing them.

Install scripts

npm packages can run scripts during installation, which is a common route for malicious packages to execute code on developer machines and CI runners. Consider disabling install scripts by default with ignore-scripts and allowing them only for packages that genuinely need them. Newer package managers such as pnpm make this an explicit allow list.

Automate updates

Old dependencies accumulate known vulnerabilities. Tools such as Dependabot and Renovate open small pull requests for updates, which your tests then check. Group minor updates, review major ones carefully, and merge regularly so you are never years behind.

A brief cooldown before adopting brand new releases, for example a few days, avoids picking up a malicious version during the short window before it is detected and removed. Renovate supports this with a minimum release age setting.

Know what is vulnerable

Run a dependency vulnerability scanner in CI and on a schedule, using sources such as the GitHub Advisory Database and OSV. Prioritise findings in code you actually call, and fix by updating rather than suppressing whenever you can.