Skip to content
hashkey.bond

Archivesecurity

Supply Chain: You Are What You Install

Dependencies run with your privileges. Lockfiles, provenance, and least privilege are the controls that matter.

Published
Reading time
1 min read

Most code in a modern application is written by someone else. A compromised package, a typosquatted name, or a malicious postinstall script executes with your build credentials and production access.

Attack surfaces

  • Registry packages: typosquats, dependency confusion, hijacked maintainer accounts.
  • Build scripts: postinstall hooks running arbitrary code.
  • CI secrets: a compromised action or plugin exfiltrating tokens.
  • Container images: mutable tags, unpinned base images.

Controls that help

  • Lockfiles with integrity hashes, plus a private registry or allowlist.
  • Dependency pinning by digest for images and actions.
  • --ignore-scripts where feasible, or run installs in a sandbox.
  • Short-lived, scoped CI credentials; no long-lived cloud keys in secrets.
  • Provenance and SBOMs so you can answer "where did this binary come from?".

Takeaway: treat dependencies as untrusted code with your privileges. Pin, verify, sandbox installs, and limit what a compromised build can reach.