DevSecOps › Module 8 › Lesson 3
Dependency Risk
Dependency risk literacy — transitive depth, known CVE link, unmaintained package stub, license risk, upgrade path — risk rows on YOUR `$DEVSEC_LAB` dependency trees.
Visual · t36_dependency_risk
Dependency risk = named supply rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Transitive dependencies hide CVE debt — name dependency risk rows on YOUR lab trees before typosquatting stranger org package feeds.
Dependency risk literacy names: transitive dependency depth category, known CVE link category (from SBOM/Trivy literacy), unmaintained package signal category, license compliance stub category, and upgrade/remediation path category. Analyst documents dependency risk register on `$DEVSEC_LAB` lab repo — three dependencies with risk row each — without publishing typosquat packages to public registries, without dependency confusion attacks on stranger orgs, without malicious package upload recipes. Cyberlium links SBOM to actionable risk — YOUR notes. Refused: typosquatting, dependency confusion attacks, malicious package guides. Lab row: dependency risk register (three deps, depth, CVE link, upgrade path).
1. Named risk rows
Transitive depth, CVE link, unmaintained signal, license stub, upgrade path — five literacy anchors.
Each dep links Module 8-2 SBOM component — same supply thread.
Command guide
Try these commands — Named risk rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA SBOM — https://www.cisa.gov/sbom NIST SSDF PS.2 — https://csrc.nist.gov/Projects/ssdf Syft — https://github.com/anchore/syft
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_SBOM=${DEVSEC_SBOM:-$DEVSEC_LAB/sbom}
cat > "$DEVSEC_SBOM/supply-chain-response.md" <<'EOF'
# Supply Chain Response — YOUR org stub
## When new CVE drops (tabletop)
1. Query SBOM for affected component + version
2. Classify exposure: direct dep vs transitive vs not present
3. Patch: bump version, rebuild image, re-run trivy image
4. Communicate: internal advisory + customer notice if shipped
## Lab mapping
- alpine:3.14 in Dockerfile → trivy HIGH/CRITICAL → bump to current alpine
- Document in findings/backlog.csv as DEVSEC-FND-*
## Refusals
- No scraping stranger SBOMs or registries for intel gathering
EOFCommand — copy this
grep -E 'CVE|trivy|Refusals|SBOM' "$DEVSEC_SBOM/supply-chain-response.md"
python3 -c "print('SBOM response: inventory → classify → patch → rescan')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA SBOM (https://www.cisa.gov/sbom); NIST SSDF PS.2 (https://csrc.nist.gov/Projects/ssdf); Syft (https://github.com/anchore/syft). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Upgrade discipline
Upgrade path documented per risk row — lab or ticket path literacy.
Unmaintained signal cites last-publish date stub — not guesswork.
3. Refused
No typosquat packages; no dependency confusion attacks; no malicious upload recipes.
Risk literacy supports remediation — not supply chain offense.
4. What you ship: dependency risk register
Three deps + depth + CVE link + upgrade path + NEVER typosquat line.
5. What you record before the next lesson
Dependency risk register path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish typosquat npm package mimicking popular library as 'dependency risk demo' on public registry.
Right
Dependency risk register from `$DEVSEC_LAB` lab repo. Next: Supply Lab.
Mission: dependency risk register
1) Name five dependency risk rows. 2) Three deps from lab tree. 3) CVE link and upgrade path each. 4) Write NEVER typosquat line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Transitive depth — literacy triage threshold stub?”
Knowledge Check
APPLY: Dependency risk literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Typosquat packages are course lab.
True or False
Knowledge Check
APPLY: Risk register includes:
Multiple choice