Lucky

You install a package. It solves a problem. You move on. You do not think about it again. But that package is now part of your application. It has access to your data. It runs in your environment.

If that package has a vulnerability, so do you.

The Numbers

A typical Node.js project has over 500 dependencies. A Python project has over 100. A Rust project has over 50. Most developers do not know what is in their dependencies. They know the top-level packages. They do not know the transitive ones. The packages that are three levels deep. The ones that were installed by a package that was installed by a package.

Those are the dangerous ones.

The Problem Is Not The Maintainers

Most maintainers are doing their best. They fix vulnerabilities when they are reported. The problem is the volume. There are over 2 million packages on npm. Hundreds of new vulnerabilities are discovered every month. You cannot manually track all of them. You need automation.

What I Do Now

Here is what I do.

Weekly: I run a dependency scan. I look at the output. I fix critical and high severity issues.

Before every release: I scan again. I make sure nothing new was introduced.

On PRs: I scan new dependencies before they are merged.

It takes 5 minutes per week. It saves me from CVEs that could have taken hours to fix later.

The "It Is Just A Dev Dependency" Trap

People say: "It is just a dev dependency. It does not matter."

But it does matter.

Some dev dependencies run in CI. Some run during build. Some run during testing. If a dev dependency is compromised, your CI environment is compromised. Your build artifacts are compromised. Your secrets are exposed.

Do not ignore dev dependencies.

What You Can Do Today

You do not need to buy anything. You do not need to spend hours.

Run a dependency scan today.

  • If you use npm: npm audit
  • If you use Python: pip-audit
  • If you use Rust: cargo audit
  • If you use Go: govulncheck

It takes 30 seconds. It tells you what is broken. Fix the critical things. Fix the high severity things. Ignore the rest. Then do it again next week.

The Bottom Line

Your dependencies are your biggest security risk. Treat them that way. Scan them. Fix them. Ship.

Discussion Question

What is the worst CVE you have found in a dependency? How did you find it?