Dependencies & SCA

Modern software is mostly third-party code: a typical app has hundreds of transitive dependencies. SCA (Software Composition Analysis) inventories and assesses that external code for known vulnerabilities and license issues. It’s the direct answer to Log4Shell.

The supply-chain problem

- your code is the tip of the iceberg; beneath it are hundreds of deps (direct + TRANSITIVE)
- a vuln in a deep transitive dep is YOUR vuln (Log4Shell was "buried")
- risks: known vulns (CVE), malicious packages, typosquatting, dependency confusion

SCA and SBOM

SCA    identifies dependencies and cross-references them with vuln databases (CVE/GHSA/OSV)
SBOM   Software Bill of Materials: full inventory of components (CycloneDX/SPDX)
       -> without an SBOM, facing a Log4Shell you don't know WHERE you have it
# generate an SBOM per build and store it -> fast response to the next mass vuln

Package supply-chain attacks

Typosquatting        a package named like the legit one (reqeusts vs requests)
Dependency confusion  publishing a package to a public repo with an internal name
                      -> the manager prioritizes the malicious public version
Compromised package  hacked maintainer / stolen account injects code (event-stream)
Protestware          the author themselves sabotages their package

Tools

SCA        Dependabot/GitHub, Snyk, OWASP Dependency-Check, Trivy, Grype, osv-scanner
SBOM       Syft (generates), CycloneDX, SPDX
Pinning    lockfiles (package-lock, poetry.lock) + hashes -> reproducible builds

Management (not just detection)

- prioritize by EXPLOITABILITY and whether the vuln is REACHABLE (is that function used?) not just CVSS
- update carefully (tests) ; unmaintained dependencies = risk to plan for
- private/proxy repos (Artifactory/Nexus) + signature/hash verification
- policy against dependency confusion (scopes, internal repo priority)

Blue Team / AppSec

SCA + SBOM on every build: an inventory to respond fast to the next mass vuln.
Prioritize by exploitability/reachability (EPSS/KEV, see Vulnerability management), not CVE volume.
Mitigate dependency confusion/typosquatting with internal repos, scopes, and signature verification.
Automate updates (Dependabot) with tests; plan for abandoned deps.

CVEs and real-world cases

Log4Shell (CVE-2021-44228): ubiquitous transitive dep; those with an SBOM responded in hours, not weeks.
event-stream (2018) and xz/liblzma (CVE-2024-3094): compromised packages in the supply chain.
Dependency confusion (Alex Birsan, 2021): achieved execution at Apple, Microsoft, and others by publishing public namesake packages.

Testing checklist

SCA in CI cross-referencing CVE/GHSA/OSV
SBOM generated per build (Syft/CycloneDX) and stored
Prioritization by exploitability/reachability (not just CVSS)
Lockfiles with hashes (reproducible builds)
Dependency confusion mitigation (internal repos/scopes)
Automated updates with tests (Dependabot)
Package signature verification where possible