Dependencies
npm audit, pip audit, SBOM literacy — patch YOUR $REPO lockfiles, not shame strangers.
Visual · t17_dependencies
Your app is mostly other people's code — track it. Original Cyberlium.
One vulnerable lodash version in YOUR package-lock is YOUR incident — when you ship it.
Dependency scanning (npm audit, pip audit, yarn npm audit, Dependabot/Renovate literacy) maps lockfiles to known CVEs. Understand direct vs transitive deps, severity, and available fix versions. Update $REPO lockfiles on schedule; test after bump. SBOM export (CycloneDX/spdx) documents what you ship. Never mass-file issues on maintainer repos from automated scans without verification; never 'audit' stranger production deploy artifacts you downloaded — fix YOUR tree.
1. Audit commands
npm audit / npm audit fix --dry-run; pip audit; go list -m -u all literacy per stack.
Read advisory links — not every high is reachable in your code path.
Command guide
Try these commands — Audit commands
═══ LINUX / BASH (Network & Reconnaissance Audit) ═══
Scan target host for open ports and service version signatures
Command — copy this
nmap -sS -sV -p 80,443,8080 -Pn ${LAB_HOST:-127.0.0.1}DNS and WHOIS reconnaissance on authorized domain
Command — copy this
dig +short A target.local dig +short MX target.local whois target.local 2>/dev/null | grep -iE "(Registrar|Creation Date|Name Server)" | head -6
Inspect HTTP headers for technology stack fingerprinting
Command — copy this
curl -s -I "http://${LAB_HOST:-127.0.0.1}:8080" | grep -iE "(Server|X-Powered-By|Set-Cookie|Content-Security-Policy)"Primary tools to practice this lesson: python3, grep. Reference sites: Dependency check (https://owasp.org/www-project-dependency-check/); npm audit (https://docs.npmjs.com/cli/v10/commands/npm-audit). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Fix discipline
Prefer semver-compatible patch/minor bump; major may need code change.
Commit lockfile updates with test run note in $REPO.
3. Scope
Scan dependencies in $REPO only. Forked course starter counts as yours.
No scraping npm for 'most vulnerable packages' attack lists — defender fix focus.
4. What you ship: dependency hygiene notes
Audit command for your stack + direct vs transitive + fix workflow on $REPO.
5. What you record before the next lesson
Dependency notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Publish list of vulnerable third-party repos to Twitter for clout.
- Right: Name dependency audit. Next: DAST deps lab.
Mission: dependency audit
1) Run audit on $REPO. 2) Classify one direct and one transitive finding. 3) Apply or document deferral with reason.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When is CVE not reachable?”
APPLY: npm audit checks:
APPLY: True or False: Ignoring all CVEs forever is fine.
APPLY: Transitive dependency: