Risk from code you did not write.
WHERE IT COMES FROM
Libraries you install Their dependencies Third-party scripts loaded into pages Build tools
WHAT THE RISK IS
A compromised or malicious package running with your application's privileges.
WHAT TO DO
Pin versions Commit the lock file Check automatically for known vulnerabilities Review what you actually need Remove what is unused
WHAT TO BE CAREFUL WITH
Packages with names similar to popular ones Packages with very few users Packages that execute code on installation Dependencies with many of their own
WHAT TO CHECK BEFORE ADDING ONE
Whether it is maintained How widely used it is What it brings with it Whether you need it at all
WHAT THIRD-PARTY SCRIPTS IN PAGES CAN DO
Everything your own scripts can, including reading what users type.
WHAT TO DO ABOUT THEM
Minimise them, and understand what each does.
WHAT TO CONSIDER
Subresource integrity, which verifies external files have not changed.
WHAT TO REVIEW
Dependencies, periodically.
