Safe dependencies

In plain English

A lockfile records the exact versions of every package your project installed, so everyone builds with the same code and a small update cannot sneak in. Running npm audit compares your dependency tree against a database of known vulnerabilities and reports problems you can then fix or upgrade. Supply-chain risk is the danger that code you did not write yourself, or one of its many transitive dependencies, was compromised before it reached you. Pinning means fixing a dependency to a specific version or using a lockfile so an unexpected new release cannot change your build without review. Before adding a new package, check how widely it is used, how recently it was updated, who maintains it and what permissions it requests, because every new dependency is code you are now responsible for.

Step by step

1. 1Commit your lockfile so every install resolves to the same versions.
2. 2Install from the lockfile in clean environments with a command that does not silently change versions.
3. 3Run an audit against your dependency tree and read each reported issue.
4. 4Upgrade or patch the vulnerable packages and re-run the audit to confirm it is clean.
5. 5Before adding a new package, check its maintenance, popularity and what it pulls in.

npm ci
npm audit
npm audit fix
npm install --save-exact lodash@4.17.21

Common mistakes

• Installing without a lockfile lets a new minor or patch release change the code you ship without any review.
• Ignoring audit output because most warnings are low severity can leave a real, exploitable hole unnoticed.
• Adding a package because it saves one function pulls in its entire dependency tree, which is now yours to maintain.
• Assuming a package is safe because it is popular misses the risk that a once-trusted project was taken over.