dependency-audit

Dependency audit and supply chain

Two failures, opposite directions: shipping a package nobody vetted (install script, typosquatted name, unmaintained transitive dep), and burning a day on advisories that are unreachable in this app. Both come from not asking is this reachable, and what does it cost to remove.

When to activate

• Before npm i <new-package> (or pip/go/cargo/composer equivalent).
• npm audit / Dependabot / Snyk / GitHub alert, or a CI security job failing.
• A PR whose diff includes a lockfile.
• Post-incident: "was this package the way in?"

Adding a dependency — the 60-second vet

1. Do you need it? Platform first: Intl, URL, fetch, crypto.subtle, structuredClone, CSS :has. A 3-line helper beats a transitive tree.
2. Is the name right? Typosquats live one character away (react-domm, lodash.js, crossenv, discord.js-selfbot). Copy the name from the official docs, never from a model's memory or a blog post.
3. Is it alive? Last publish, open-issue trend, maintainer count, downloads. One maintainer + last release three years ago = you are adopting the code.
4. What does it drag in? npm view <pkg> dependencies / npx howfat <pkg> — count transitives and installed size before, not after.
5. Does it run code on install? npm view <pkg> scripts — a postinstall in a utility library is a red flag; install with --ignore-scripts if you must.
6. License compatible? MIT/Apache-2.0/BSD fine for most products; AGPL/SSPL and "source-available" licenses are a legal decision, not a dev one.
7. Pin it. Exact version in package.json (no ^ for anything security- or build-critical), lockfile committed, npm ci in CI — never npm install there.

Triaging an advisory

Run the tool, then think — the count is not the finding.

npm audit --json            # or: pnpm audit / yarn npm audit
npm ls <vulnerable-pkg>     # WHO pulls it in — the fix lives at that edge
pip-audit                   # python
govulncheck ./...           # go: reports reachable symbols, not just versions
cargo audit                 # rust
composer audit              # php