Your product depends on about 1,200 npm packages nobody audited, and each one is an entrance. Supply chain security reached board agendas because recent attacks compromised entire build pipelines through a single well-maintained package. Five technical workstreams cover the ground, none requires rewriting the product, and prevention costs a fraction of one compromised production build.
The attack surface in numbers
A modern application drags hundreds to thousands of transitive dependencies: you audit 80 direct packages and inherit a thousand more without reading a line. Attacks repeat the same pattern, compromise the maintainer of a popular package and wait for the next release. Tools such as npm ls and Syft map the tree in minutes; inventory comes before policy. One compromised transitive package is enough; the attacker never touches your source code. Every PR that adds a library widens the surface.
Lockfiles, pinning, and automation with a human gate
- Commit the lockfile and block merges without it.
- Pin exact versions on critical execution paths.
- Review the full diff in dependency PRs, beyond the changelog.
- Run Renovate or Dependabot to propose updates, with mandatory human approval.
The human gate matters: automation proposes, a person approves, and the review history stays on record for audits. Cache dependency installs keyed on the lockfile hash so builds stay reproducible.
SBOM and provenance: proof over promises
Generate a SBOM per release artifact; regulators and enterprise buyers request the document in procurement today. CI tooling produces SBOMs at near-zero cost. Sigstore signatures and npm provenance attestations verify that an artifact came from its claimed source; mirror the verification in internal registries.
Vendors and the incident playbook
Third-party components deserve a questionnaire covering maintenance status and response history to past CVEs. Ask how many active maintainers a component has: a single-maintainer package carries concentration risk, one person disappears and a hundred applications stand exposed. Decide before the incident who approves emergency upgrades, how to freeze deploys, and how to notify customers when a CVE hits production. Making those calls during a crisis multiplies the damage.
The signal that comes from the top
Security work competes with features for engineering capacity. Allocate 10% to 15% of engineering time to this backlog as a standing quota: without a fixed share, the roadmap wins every sprint and risk grows in silence. One production dependency incident eats weeks of remediation; the preventive quota costs a fraction of that. Budget communicates priority better than any kickoff speech. Report the quota status every quarter next to feature delivery.
