Stop 10 · Application Security (AppSec)Topics · 5/9

Software Composition Analysis (SCA)

In short

Most of your app is code you did not write: open source libraries. SCA checks those dependencies for known vulnerabilities, because a hole in a library is a hole in your app.

Scanning a project's third-party dependencies for known vulnerabilities — since most modern applications are built on many external libraries, this is often where the most exploitable vulnerabilities actually live.

The blob caterer checks tins of ingredients against a list before cooking.

Think of it like this

Checking the ingredients, not just the recipe

A caterer may cook perfectly, but if one tin of supplied tomatoes is spoiled, the whole dish is unsafe. SCA checks every ingredient you bought in, the open source packages, against a list of known bad batches before you serve.

Watch it happen

How SCA protects you

List deps

Check feed

Flag risky

Update

1/4The tool reads your lock file to see every direct and indirect dependency.

The big ideas

What you need to know

You ship others' code

Modern apps pull in hundreds of packages. A flaw in any one of them becomes your flaw too.

Transitive counts

A library you installed may pull in others you never chose. SCA checks the whole dependency tree, not just the top.

Keep it current

New vulnerabilities are found daily. Run SCA on every build and keep dependencies patched.

Mind the licence too

Some SCA tools also flag licences, so you avoid a package whose terms clash with your project.

See it in code

Walk through the code

bash

1# Check your Node project dependencies for known vulnerabilities2npm audit --audit-level=high3 4# A deeper, free option across many languages5# Scans the whole dependency tree, not just direct packages6npx osv-scanner --lockfile=package-lock.json

1/2npm audit flags dependencies with known vulnerabilities at high severity or above.

Both commands read your lock file and list dependencies with known issues, so you can update them before an attacker exploits a known hole.

Save yourself the pain

Common mistakes

Oops

Only checking the libraries you directly installed.

Do this instead

Those pull in others automatically. Scan the whole tree, since a buried transitive dependency can be the weak point.

Oops

Running SCA once and never again.

Do this instead

New flaws are reported daily in packages you already use. Scan on every build and keep updating.

Your mission

Audit a project's dependencies

~30 min

Quick check

Why does SCA check transitive dependencies, not just the ones you installed directly?

Go deeper

1Run an SCA scan (like Snyk or Dependabot) on a sample project and review flagged dependencies.
2Learn why a project can be vulnerable through a transitive dependency it doesn't directly control.
3Understand why keeping dependencies updated is simple in theory but often neglected in practice.