Backend Dependency Security — Managing Supply Chain Security

// Dependency vulnerability check
const { execSync } = require('child_process');

function checkDependencies() {
  // npm audit
  const result = JSON.parse(execSync('npm audit --json').toString());
  const vulnerabilities = result.vulnerabilities || {};

  const summary = {
    total: Object.keys(vulnerabilities).length,
    critical: 0,
    high: 0,
    moderate: 0,
    low: 0,
    details: []
  };

  for (const [pkg, info] of Object.entries(vulnerabilities)) {
    summary[info.severity]++;
    summary.details.push({
      package: pkg,
      severity: info.severity,
      title: info.title,
      patchedIn: info.patched_versions,
      vulnerableVersions: info.vulnerable_versions
    });
  }

  return summary;
}

// Automated dependency update check
async function checkForUpdates() {
  const outdated = JSON.parse(execSync('npm outdated --json').toString());
  const updates = [];

  for (const [pkg, info] of Object.entries(outdated)) {
    updates.push({
      package: pkg,
      current: info.current,
      wanted: info.wanted,
      latest: info.latest,
      age: info.age
    });
  }

  return updates;
}

// SBOM generation
function generateSBOM() {
  const manifest = require('./package.json');
  const lockfile = require('./package-lock.json');

  const sbom = {
    bomFormat: 'CycloneDX',
    specVersion: '1.4',
    version: 1,
    metadata: {
      component: { name: manifest.name, version: manifest.version }
    },
    components: Object.entries(lockfile.packages || {})
      .filter(([name]) => name !== '')
      .map(([name, info]) => ({
        name: name.replace('node_modules/', ''),
        version: info.version,
        licenses: info.license ? [{ license: { name: info.license } }] : [],
        purl: `pkg:npm/${name.replace('node_modules/', '')}@${info.version}`
      }))
  };

  return sbom;
}

// CI/CD check
// package.json scripts
// "security:audit": "npm audit --audit-level=high"