Modern applications assemble hundreds of open source packages, each one a trust decision made by a stranger. Supply chain attacks exploit exactly that trust, and they bypass every firewall you own.
How the attacks actually happen
Typosquatting publishes lookalike package names. Account takeover pushes a malicious patch to a popular library. Protestware and compromised build plugins execute in CI with your credentials attached. The vector is almost never code review; it is habit.
Defense in depth for dependencies
Lockfiles with integrity hashes, pinned versions and automated vulnerability scanning form the baseline. Build systems need least privilege: a test runner does not need deploy keys. New packages enter through an approval gate with maintainer and download history checks.
You do not need to audit every line. You need to know which packages you would defend in an incident.
The minimal workable policy
- Generate a software bill of materials on every build.
- Alert on new dependencies introduced outside review.
- Subscribe to advisories for your actual runtime stack.
- Rehearse the response: revoke, pin, rebuild, disclose.
Dependency hygiene is unglamorous, but at ByteHexa it is the difference between a Tuesday patch and a breach disclosure letter.
