dependency-supply-chainlisted

# Dependency / Supply-Chain Security The supply chain is the part of your stack you trust by default and rarely review. npm, PyPI, RubyGems, Maven, Go modules — they have all hosted malicious packages, typosquats, and compromised maintainer accounts at scale. This skill is the working developer's defense — pragmatic checks that fit in a normal workflow, not a software bill-of-materials regulatory program. ## When to invoke - Adding a new dependency to a project (especially a small / new / single-maintainer one) - After a publicized supply-chain incident affecting your ecosystem - Quarterly audit of `package.json` / `requirements.txt` / `go.mod` - Inheriting a project with a large `node_modules` and no obvious hygiene - CI/CD just leaked a secret — start here to find which dep grabbed it ## The threat model What can a malicious dependency actually do? - **Read environment variables / files during install** (postinstall script) - **Read environment variables / files at runtime** (any code path) - **Exfiltrate via outbound HTTPS** to any host - **Modify other dependencies** (link-stage tampering, build-script monkey-patching) - **Hide payloads in transitive deps** so your `package.json` looks clean You cannot inspect every line of every dependency. You can raise the cost of attacks and detect them when they happen. ## Lockfile hygiene A lockfile is the only thing standing between "I added one dep" and "my install grabbed 1,200 transitive deps any of which can be swappe