Supply Chain and Dependencies

Last reviewed Jun 1, 2026 Content v20260601

Track mode

none

Means

Read / quiz

Reading

~1 min

Level

advanced

This lesson

This lesson teaches Supply Chain and Dependencies: security mindset, common threats, and defensive practices for software teams.

One malicious npm package can compromise thousands of downstream apps.

You will apply Supply Chain and Dependencies in contexts like: Web apps, APIs, CI/CD, and organizational compliance programs.

Read scenario-based lessons, map controls to code you write on other tracks, and complete MCQs—practice threat modeling on paper or in docs.

When identity, web, and crypto/network fundamentals from intermediate lessons are familiar.

Attackers compromise libraries, build tools, or npm packages you import—SolarWinds-style trust chain risk.

Habits

See Git signing and branch protection practices.

Q: Typosquatting?
A: Malicious package with name near lodash.
Q: SBOM?
A: Software bill of materials listing components for incident response.

Pitfall: npm install without checking package age and maintainer—typosquat risk.

Discussion

Past discussion is visible to everyone. Only logged-in users can post comments and replies.

Starter discussion topics

No discussion yet. Be the first to ask a question.