intermediate
Dependency vulnerabilities
Manage package risk with lockfiles, audit triage, minimal dependency surface, provenance, updates, and runtime containment.
Node apps inherit transitive risk from npm dependencies — supply chain hygiene reduces attack surface and incident frequency.
Practices:
- Commit lockfiles (`package-lock.json`, `pnpm-lock.yaml`) for reproducible installs
- Run `npm audit` / OSV / Snyk in CI — triage by exploitability and reachability, not raw count
- Minimize dependencies; prefer maintained packages with few transitive deps
- Pin and review major upgrades; use Dependabot with policy
- `npm ci` in CI instead of mutable `npm install`
Runtime containment: do not run npm install as root in prod; read-only filesystem; network egress limits for unexpected callbacks.
On interviews: how you triage a critical advisory in a transitive dep; difference between devDependency risk and production bundle.
Common pitfalls: audit fix --force breaking builds; ignoring advisories on unused code paths without verifying; no lockfile discipline.
The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.
Checklist:
- Lockfile enforced in CI.
- Documented vuln SLA by severity.
- Regular dependency update cadence.
- SBOM or inventory for releases.