#46 Package Dependencies: Understanding and Mitigating Issues
Every line of code you don't write yourself is a potential security risk. Learn how to protect your software from attacks through third-party packages. From automation to manual reviews.
In today's world of software development, we can't build everything ourselves. That is why we use third-party packages, which become part of our software supply chain, alongside our own code. We typically manage them through managers like NPM or NuGet.
But there is a catch. While we keep an eye on our own code, we don't have the same control over external packages. Whether they are open-source or paid ones, changes in their code might slip by unnoticed, creating security risks.
Let's say you need to validate API parameters in your application. Instead of writing this from scratch, you find a popular open-source library, version 1.34.0. It looks great - hundreds of thousands of projects use it, and your tests show it works perfectly.
But what if someone discovers a major security hole in version 1.34.0? The library team releases version 1.34.1 with a fix, but if your team misses this update, your application stays vulnerable. An attacker could use this known weakness to break into your system.
That is why keeping packages updated is crucial. Package providers often release updates to fix bugs and add features. But new versions can also bring their own problems - like version 1.35.0 accidentally introducing a new security flaw that goes unnoticed.
Watch out for "dead projects" too - libraries that nobody maintains anymore. These are more likely to have security problems. If you find one, switch to something else quickly. If you can't find a good replacement, consider building the feature yourself or even taking over the project's development within your company (e.g. by forking).
Be suspicious if a package that hasn't changed in years suddenly gets an update. This could be someone trying to slip in malicious code. Take your time to verify these unexpected updates before using them.
Such issues happen because your software is only as secure as its weakest part. Even with good monitoring, we might miss update notifications or not realize their importance. Sometimes we delay updates because they require big code changes.
One good solution is using tools like Dependabot in GitHub. It watches your dependencies and can even create automatic update requests. While this helps keep everything current, you still should check each update carefully. If you know an update might cause problems, plan time for it - especially if your current version has some security issues.
Another valuable approach is conducting monthly package audits. Set aside time each month to review your dependencies, checking for security advisories, recent updates, and overall package health. During these reviews, evaluate metrics like download counts, GitHub stars, and recent commits to gauge if packages are still actively maintained. Also, examine release notes and changelogs for potential security implications. This way you can identify risky dependencies before they become problems and it lets you plan migrations away from problematic packages well in advance.
How do you deal with keeping packages up to date?