Secure › Module 8 › Lesson 3
Dependencies
npm audit, pip audit, SBOM literacy — patch YOUR $REPO lockfiles, not shame strangers.
Visual · t17_dependencies
Your app is mostly other people's code — track it. Original Cyberlium.
Opening
One vulnerable lodash version in YOUR package-lock is YOUR incident — when you ship it.
Dependency scanning (npm audit, pip audit, yarn npm audit, Dependabot/Renovate literacy) maps lockfiles to known CVEs. Understand direct vs transitive deps, severity, and available fix versions. Update $REPO lockfiles on schedule; test after bump. SBOM export (CycloneDX/spdx) documents what you ship. Never mass-file issues on maintainer repos from automated scans without verification; never 'audit' stranger production deploy artifacts you downloaded — fix YOUR tree.
1. Audit commands
npm audit / npm audit fix --dry-run; pip audit; go list -m -u all literacy per stack.
Read advisory links — not every high is reachable in your code path.
Command guide
Try these commands — Audit commands
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Dependency check — https://owasp.org/www-project-dependency-check/
Optional command
npm audit — https://docs.npmjs.com/cli/v10/commands/npm-audit
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t17-demo/pkg"
cat > "$HOME/cyberlium-lab/t17-demo/pkg/package.json" <<'EOF'
{"name":"t17-lab-deps","version":"1.0.0","dependencies":{"lodash":"4.17.4"}}
EOFCommand — copy this
cd "$HOME/cyberlium-lab/t17-demo/pkg" && npm audit --json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print('vulnerabilities:', d.get('metadata',{}).get('vulnerabilities',{}))" 2>/dev/null || npm audit 2>/dev/null | head -15
pip list 2>/dev/null | head -10Primary tools to practice this lesson: python3, grep. Reference sites: Dependency check (https://owasp.org/www-project-dependency-check/); npm audit (https://docs.npmjs.com/cli/v10/commands/npm-audit). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Fix discipline
Prefer semver-compatible patch/minor bump; major may need code change.
Commit lockfile updates with test run note in $REPO.
3. Scope
Scan dependencies in $REPO only. Forked course starter counts as yours.
No scraping npm for 'most vulnerable packages' attack lists — defender fix focus.
4. What you ship: dependency hygiene notes
Audit command for your stack + direct vs transitive + fix workflow on $REPO.
5. What you record before the next lesson
Dependency notes path.
6. Wrong vs right: stranger apps vs YOUR repo
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish list of vulnerable third-party repos to Twitter for clout.
Right
Name dependency audit. Next: DAST deps lab.
Mission: dependency audit
1) Run audit on $REPO. 2) Classify one direct and one transitive finding. 3) Apply or document deferral with reason.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “When is CVE not reachable?”
Knowledge Check
APPLY: npm audit checks:
Multiple choice
Knowledge Check
APPLY: True or False: Ignoring all CVEs forever is fine.
True or False
Knowledge Check
APPLY: Transitive dependency:
Multiple choice