Dependency Risk Audit

Third-party packages are the most common source of supply-chain compromise and known-vulnerability exploitation. Treat dependency selection as a security decision, not just a convenience one.

CVE and Known Vulnerability Triage

Run the ecosystem's native audit tool first (npm audit, pip-audit, bundle audit, govulncheck). For each finding:

• Confirm exploitability in context — a CVE in a CLI-only code path of a server-side lib may not be reachable.
• Check whether a fixed version exists and whether upgrading is a semver-compatible bump.
• Flag any CVSS 7.0+ finding with no available fix as a blocking risk requiring a compensating control or replacement.

Do not dismiss findings without a written reason.

Maintenance Health Signals

A dependency with no CVEs today can become a liability tomorrow. For any new or high-traffic dependency check:

• Last release date and commit activity (no release in 24+ months on an active ecosystem is a yellow flag).
• Number of open security issues versus closed.
• Whether the package has a documented security policy or contact.
• Single-maintainer packages without a succession plan carry concentration risk — flag them.

Supply-Chain Hygiene

Install-time attacks abuse package publication pipelines. Apply these checks:

• Verify the package name exactly matches the intended project — typosquatting is common.
• Confirm the publisher identity on the registry matches the known author or organization.
• Prefer packages that publish provenance attestations (SLSA, npm provenance, sigstore) when available.
• Pin transitive dependencies in lockfiles and commit them to source control. Never allow floating ranges in production lockfiles.
• Enable automated lockfile integrity checks in CI (npm ci, not npm install).

License Risk

Licenses create legal exposure, not just engineering risk. Flag any dependency with a copyleft license (GPL, AGPL, EUPL) in a proprietary codebase — these require legal review before shipping. Acceptable defaults for most commercial projects: MIT, Apache-2.0, BSD-2, BSD-3, ISC.

Remediation Priority

Rank findings: (1) exploitable CVE with available fix, (2) exploitable CVE no fix — needs replacement, (3) abandoned package on a critical path, (4) license conflict, (5) maintenance concern only. Address (1) and (2) before any release. Defer (5) to a scheduled dependency hygiene sprint.