Dependency & Supply Chain Security

# Dependency & Supply Chain Security

## npm audit
```bash
# Check for known vulnerabilities
npm audit

# Auto-fix safe updates
npm audit fix

# Fix breaking changes (review carefully)
npm audit fix --force

# CI: fail on high/critical
npm audit --audit-level=high
```

## Lock files
- Always commit `package-lock.json` / `pnpm-lock.yaml`.
- Use `npm ci` (not `npm install`) in CI — installs exact versions from lockfile.
- Review lockfile changes in PRs.

## Dependency review
```bash
# Check package before installing
npx bundlephobia <pkg>         # size
npx npm-check-updates          # outdated deps
npx depcheck                    # unused deps

# Socket.dev — detect supply chain attacks
npx socket optimize             # find lighter alternatives
```

## Typosquatting defense
- Verify package name matches official docs.
- Check npm weekly downloads, repo link, author.
- Use scoped packages when available (`@org/pkg`).
- Pin exact versions for critical deps: `"react": "18.2.0"` not `"^18.2.0"`.

## Subresource Integrity (SRI)
```html
<!-- Verify CDN scripts haven't been tampered with -->
<script
  src="https://cdn.example.com/lib.js"
  integrity="sha384-abc123..."
  crossorigin="anonymous"
></script>
```
Generate: `openssl dgst -sha384 -binary lib.js | openssl base64 -A`

## Automated scanning
```yaml
# GitHub Actions — Dependabot
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
    open-pull-requests-limit: 10
```

## Snyk integration
```bash
npx snyk test          # test for vulnerabilities
npx snyk monitor       # continuous monitoring
```

## Checklist
- [ ] Run `npm audit` in CI pipeline.
- [ ] Commit lockfiles, use `npm ci` in CI.
- [ ] Review new dependency additions in PRs.
- [ ] Enable Dependabot or Renovate for auto-updates.
- [ ] Pin critical dependencies to exact versions.
- [ ] Periodically run `depcheck` to remove unused deps.
- [ ] Use SRI for external CDN scripts.