Dependency Risk

Dependency risk literacy — transitive depth, known CVE link, unmaintained package stub, license risk, upgrade path — risk rows on YOUR `$DEVSEC_LAB` dependency trees.

Dependency Risk• Audio Walkthrough

00:00/03:07

Visual · t36_dependency_risk

Dependency risk = named supply rows. $DEVSEC_LAB. Original Cyberlium.

Transitive dependencies hide CVE debt — name dependency risk rows on YOUR lab trees before typosquatting stranger org package feeds.

Dependency risk literacy names: transitive dependency depth category, known CVE link category (from SBOM/Trivy literacy), unmaintained package signal category, license compliance stub category, and upgrade/remediation path category. Analyst documents dependency risk register on `$DEVSEC_LAB` lab repo — three dependencies with risk row each — without publishing typosquat packages to public registries, without dependency confusion attacks on stranger orgs, without malicious package upload recipes. Cyberlium links SBOM to actionable risk — YOUR notes. Refused: typosquatting, dependency confusion attacks, malicious package guides. Lab row: dependency risk register (three deps, depth, CVE link, upgrade path).

1. Named risk rows

Transitive depth, CVE link, unmaintained signal, license stub, upgrade path — five literacy anchors.

Each dep links Module 8-2 SBOM component — same supply thread.

Command guide

Try these commands — Named risk rows

═══ DOCKER & CONTAINER AUDIT ═══

Check container running state and port bindings

Command — copy this

docker ps --format "table {{.ID}}	{{.Image}}	{{.Status}}	{{.Ports}}" 2>/dev/null || echo "docker ps"

Inspect container for elevated capabilities and root user

Command — copy this

docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || true

Run security vulnerability scan on container image using Trivy

Command — copy this

trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"

═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace

Command — copy this

kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"

Primary tools to practice this lesson: grep, python3. Reference sites: CISA SBOM (https://www.cisa.gov/sbom); NIST SSDF PS.2 (https://csrc.nist.gov/Projects/ssdf); Syft (https://github.com/anchore/syft). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Upgrade discipline

Upgrade path documented per risk row — lab or ticket path literacy.

Unmaintained signal cites last-publish date stub — not guesswork.

3. Refused

No typosquat packages; no dependency confusion attacks; no malicious upload recipes.

Risk literacy supports remediation — not supply chain offense.

4. What you ship: dependency risk register

Three deps + depth + CVE link + upgrade path + NEVER typosquat line.

5. What you record before the next lesson

Dependency risk register path.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Publish typosquat npm package mimicking popular library as 'dependency risk demo' on public registry.
Right: Dependency risk register from `$DEVSEC_LAB` lab repo. Next: Supply Lab.

Hands-on Exercise