loom-dependency-scan

Dependency Scan

CVEs, outdated packages, license compliance, and supply-chain risk across ecosystems. Deep-dependency companion to loom-security-scan (fast pre-commit/CI scanning) and loom-security-audit (methodology/compliance).

Workflow

1. Enumerate — parse manifests + lockfiles; separate direct vs transitive. No lockfile → builds aren't reproducible (fix first).
2. Scan — CVEs against advisory DBs (below); note severity, affected/fixed versions, and the dependency path.
3. Assess reachability — a CVE in an unimported/dev-only path is lower priority than one on a hot code path. govulncheck and Snyk reason about reachability; npm audit does not.
4. Remediate — minimal safe bump to the fixed version; prefer patch/minor; verify tests. Pin the result in the lockfile.

Scanning Commands

# JS      npm audit --audit-level=high   |  osv-scanner -r .
# Python  pip-audit                       |  safety check
# Rust    cargo audit                     |  cargo deny check advisories
# Go      govulncheck ./...               |  go list -m all | nancy sleuth
# Ruby    bundle audit --update
# Java    mvn org.owasp:dependency-check-maven:check
# .NET    dotnet list package --vulnerable --include-transitive
# PHP     composer audit
# Any     osv-scanner -r .   (lockfile-driven, OSV DB, all major ecosystems in one)

⚠ --vulnerable/audit tools only see what the lockfile pins — an unpinned range (^1.2.0) may resolve differently in CI. Scan the committed lockfile, and regenerate it before scanning if manifests changed.

Supply-Chain Attacks (the high-signal risks)

Registry malware now outpaces classic CVEs. Defenses are structural, not just "run audit":

• Dependency confusion — you have an internal package @acme/utils; an attacker publishes @acme/utils to the public registry with a higher version. A misconfigured resolver prefers the public one and runs attacker code at install. Defend: scope internal packages to your private registry, configure the client to never fall back to public for those scopes (npm .npmrc @acme:registry=…, pip --index-url not --extra-index-url), and claim/reserve your names on the public registry.
• Typosquatting — reqeusts, lodahs, python-dateutil vs dateutil. Review every new dependency name character-by-character; watch install-time scripts. Prefer well-known packages with history and many maintainers.
• Namespace / maintainer hijack — a legit package gets a malicious release after an account takeover or a maintainer handoff. Defend: pin exact versions + lockfile hash integrity; delay auto-adopting brand-new releases (Renovate stabilityDays); watch for sudden maintainer changes.
• Malicious install scripts — npm postinstall, pip setup.py run arbitrary code at install. Use npm ci --ignore-scripts where feasible; audit scripts of new deps.
• Integrity — commit lockfiles with hashes (package-lock.json, Cargo.lock, poetry.lock, pip-compile --generate-hashes). Hashes turn a hijacked re-publish of an existing version into a hard install failure.