Supply Chain Security
Your code is a minority of what you ship. Dependencies, lockfiles, provenance, malicious packages, CI/CD permissions and build integrity.
Every lesson below identifies the asset, attacker capability and boundary before naming the vulnerability. Controls are split into prevention, detection and recovery; residual risk is explicit.
Your code, dependencies, build tools, CI identities, registries, container bases and deployment artifacts all execute with trust.
Lockfiles, review, scanning, provenance and compatibility tests manage transitive code without treating every update as automatically safe.
A plausible package name can deliver attacker code during install or build; popularity and a familiar-looking name are not provenance.
Pull-request code, build runners, secrets and deployment authority meet in CI; trust must change across fork, branch and environment boundaries.
Build once, identify immutably, record provenance, verify before promotion and never rebuild “the same” release in a more privileged environment.