Dependencies as Attack Surface

Supply chain failure means the integrity or authenticity of software you consume (libraries, containers, plugins, CI actions) was broken — or never established. Attacker goals: run code in your build or runtime, steal secrets from CI, persist via updates. Victims often “just npm installed” or “just docker pulled.” Finding language: “Unpinned deps; no SBOM; CI can publish with overbroad token.” Fix language: “Inventory; pin; verify checksums/signatures when available; least privilege in CI; review diffs on upgrades.”

sudo apt install curl

SAFE="http://127.0.0.1:8770"

curl -sS -m 3 -I "$SAFE/" | head -n 12

Direct dependencies are what you declared. Transitive ones arrive because those packages depend on others. Attackers love deep graphs: one compromised leaf reaches thousands of apps. Literacy: generate a lockfile/tree for a project YOU own (pip freeze, npm ls --depth=0) and notice how wide it is. Do not “prove A03” by uploading malware to a public registry.

ls -1 package-lock.json yarn.lock pnpm-lock.yaml requirements.txt poetry.lock go.sum Cargo.lock
ls -1 "$HOME/cyberlium-lab"/*lock*
find "$HOME/cyberlium-lab" . -maxdepth 3 \( -name "package-lock.json" -o -name "requirements.txt" -o -name "go.sum" -o -name "poetry.lock" \) | head -n 20

Lookalike names and unmaintained packages are common failure stories. Defender habits: spell package names carefully; prefer maintained projects; watch sudden maintainer changes; read release notes on bumps. This course does not teach how to publish malicious lookalikes. Naming the risk is enough.

printf "typosquat_named: lookalike names
abandoned_named: unmaintained with old CVEs
refuse: poisoning registries
" >> "$HOME/cyberlium-lab/a03-deps-mid-h3.txt"

Start an inventory habit: lockfiles committed; dependency review in PRs; no blind latest tags in production. Secrets out of install scripts. CI tokens scoped. Identify DEMO first so writeups use http://192.168.0.1/ as the demo asset (or note SAFE if that IP is a router). Record the habit in notes even if your toy project is tiny.

Date (UTC). A03 = Software Supply Chain Failures (OWASP Top 10:2025). Identify banner of http://192.168.0.1/ or STOP if router. Direct vs transitive one line. pip freeze / npm ls snippet (redacted). Ethics: NEVER publish malware packages; NEVER hydra/nmap the LAN. Path: $HOME/cyberlium-lab/a03-deps-notes.txt, chmod 600. Legal: original Cyberlium — not official OWASP certification.

If you have a local package.json/requirements.txt/pubspec.yaml you own, copy a redacted name list into notes. Otherwise create a tiny toy manifest under cyberlium-lab. Identify DEMO first.

sudo apt install curl
sudo apt install nmap
sudo apt install python3

brew install nmap
brew install python3

choco install nmap  # or download https://nmap.org/download.html

cd "$HOME/cyberlium-lab/a03-toy"

cat > requirements-toy.txt << 'REQ'
demo-left-pad==1.0.0
demo-http-client==2.3.1
REQ

cat > list_deps.py << 'PY'
from pathlib import Path
text = Path("requirements-toy.txt").read_text(encoding="utf-8")
lines = [l.strip() for l in text.splitlines() if l.strip() and not l.startswith("#")]
print("direct_deps_count", len(lines))
for l in lines:
print("dep:", l)
print("a03: dependencies are attack surface you chose to trust")
print("ethics: NEVER publish typosquats / malware packages; NEVER hydra/nmap the LAN")
print("legal: original Cyberlium — not official OWASP certification")
PY

python3 list_deps.py || python list_deps.py

(pip freeze || pip3 freeze || true) | head -n 15

cat > a03_optional_echo.py << 'PY'
"""Optional identify echo. Bind loopback only."""
from http.server import BaseHTTPRequestHandler, HTTPServer

HOST = "127.0.0.1"
PORT = 8770
if HOST != "127.0.0.1":
raise SystemExit("refusing non-loopback bind")

class H(BaseHTTPRequestHandler):
def do_GET(self):
    body = b"Cyberlium A03 inventory lab. DEMO writeup: http://192.168.0.1/
"
    self.send_response(200)
    self.send_header("Content-Type", "text/plain; charset=utf-8")
    self.send_header("Content-Length", str(len(body)))
    self.end_headers()
    self.wfile.write(body)

print("optional bind", HOST, PORT)
HTTPServer((HOST, PORT), H).serve_forever()
PY

cat > a03_deps_practical.sh << 'SH'

SH

{

You now treat dependencies as A03 attack surface — identify the demo, inventory first, no malicious publishes — with locked notes. Original Cyberlium — not official OWASP certification. Next — SBOM Pinning and Trust Boundaries.