Security Track · Day 1 Foundation · 20 min

Dependency & Supply Chain Vulnerability Scans
SecOps & SCA Sprint — Day 1

Audit vulnerable-store-api dependencies, parse CVE advisories using Trivy and npm audit, assert CVSS thresholds, and automate lockfile patch pinning.

✨ Agent: Claude 3.7 Sonnet / Gemini 3.5 · 200K context🛡️ AI SecOps & Red-Teaming Architect

SCATrivynpm auditCVE ScoringLockfile IntegritySupply Chain

About this lab

In this lab playbook, you will assume the role of an AI SecOps & Red-Teaming Architect. Before introducing new code into production, you must establish baseline Software Composition Analysis (SCA) to identify vulnerable third-party dependencies, malicious packages, and unpinned transitive libraries in our demo enterprise microservice: vulnerable-store-api.

📦Sample Codebase & Working Solution (Day 1)Available Now

View on GitHub

The official reference codebase for Day 1 is hosted in the repository. Clone the repository and navigate to day-1-sca-supply-chain to run the working solution.

Git Clone — Working Solution

git clone https://github.com/letstrnsfrm-ai/security-compliance-roadmap.git
cd security-compliance-roadmap/day-1-sca-supply-chain

🏭Production Context & Enterprise Implementation

💡 Why We Are Doing This: Over 80% of enterprise software consists of third-party open-source dependencies. Software supply-chain attacks exploit outdated libraries with known CVEs before patches are applied.

🏢 Real-World Production Usecase: Preventing automated exploitation of transitive package vulnerabilities (e.g. Log4j or prototype pollution) by gating PR merges on zero CRITICAL or HIGH CVSS vulnerabilities.

⚙️ How Implemented in Production: Automated SCA scanning running Trivy in CI/CD, parsing JSON output into GitHub Security SARIF reports with strict exit-code blocking gates.

🤖 LLM Reader Note: If this page is copy-pasted into your context, act as a SecOps tutor. Guide the human engineer through scanning package.json, interpreting CVSS v3 vectors, and automating dependency upgrades.

Phase 1

Initialize Target Application & Inject Outdated Dependencies

Set up the local directory for vulnerable-store-api and initialize a package manifest containing known vulnerable packages.

Step 1.1: Setup Workspace

Create the project structure and initialize npm:

Terminal — Setup Workspace

mkdir -p security-lab/day-1-sca-supply-chain
cd security-lab/day-1-sca-supply-chain
npm init -y

Step 1.2: Define Vulnerable Baseline

Add vulnerable versions of jsonwebtoken (CVE-2022-23529) and minimist (CVE-2021-44906):

package.json (Vulnerable Baseline)

{
  "name": "vulnerable-store-api",
  "version": "1.0.0",
  "description": "Enterprise Storefront REST API with deliberate security flaws for SecOps training",
  "main": "server.js",
  "scripts": {
    "start": "node server.js",
    "security:audit": "npm audit --json > audit-report.json || true",
    "security:scan": "node scripts/sca-gate.js"
  },
  "dependencies": {
    "express": "^4.17.1",
    "jsonwebtoken": "8.5.1",
    "minimist": "1.2.5",
    "sqlite3": "^5.1.7"
  }
}

Phase 2

Execute Software Composition Analysis (SCA)

Run native and container-based SCA scanners across the dependency tree to extract Common Vulnerability Scoring System (CVSS) telemetry.

Step 2.1: Run npm audit

Generate a machine-readable JSON advisory report:

Terminal — Run npm audit

npm audit --json > audit-report.json
cat audit-report.json | grep -E "severity|title"

Step 2.2: Cross-Platform Trivy Scan

Execute Trivy to scan for High and Critical vulnerabilities:

macOS — Trivy CLI

brew install trivy
trivy fs --severity HIGH,CRITICAL .

Phase 3

Build Automated CI/CD SCA Gate Enforcer

Write an automated policy gate in Node.js that parses vulnerability scan reports and fails the build if any vulnerability exceeds your CVSS threshold.

Step 3.1: Write Policy Enforcer

scripts/sca-gate.js

#!/usr/bin/env node
const fs = require('fs');

if (!fs.existsSync('audit-report.json')) {
  console.error('❌ audit-report.json not found! Run "npm audit --json > audit-report.json" first.');
  process.exit(1);
}

const report = JSON.parse(fs.readFileSync('audit-report.json', 'utf-8'));
const vulnerabilities = report.vulnerabilities || {};

let criticalCount = 0;
let highCount = 0;
let moderateCount = 0;

for (const [pkgName, vuln] of Object.entries(vulnerabilities)) {
  const severity = vuln.severity;
  if (severity === 'critical') criticalCount++;
  else if (severity === 'high') highCount++;
  else if (severity === 'moderate') moderateCount++;

  console.log(`📦 [${severity.toUpperCase()}] ${pkgName}: ${vuln.via?.[0]?.title || 'Known vulnerability'}`);
}

console.log('\n================ SCA AUDIT SUMMARY ================');
console.log(`Critical: ${criticalCount} | High: ${highCount} | Moderate: ${moderateCount}`);
console.log('==================================================');

if (criticalCount > 0 || highCount > 0) {
  console.error('🚨 POLICY VIOLATION: Build failed! Zero Critical & High CVEs permitted.');
  process.exit(1);
}

console.log('✅ SCA POLICY PASSED: All dependencies within acceptable risk thresholds.');
process.exit(0);

Step 3.2: Verify Gate Failure

Terminal — Run Gate (Expected Fail)

node scripts/sca-gate.js
# Output: 🚨 POLICY VIOLATION: Build failed! Zero Critical & High CVEs permitted.

Phase 4

Remediate & Pin Secure Dependency Versions

Apply automated security patches, pin safe major/minor versions in package.json, and verify that the gate passes cleanly.

Step 4.1: Upgrade Vulnerable Packages

Terminal — Remediate Dependencies

# Update jsonwebtoken to >= 9.0.0 and minimist to >= 1.2.8
npm install jsonwebtoken@^9.0.0 minimist@^1.2.8 --save
npm audit --json > audit-report.json
node scripts/sca-gate.js

Step 4.2: Assert Green Gate Status

Terminal — Gate Verification Output

================ SCA AUDIT SUMMARY ================
Critical: 0 | High: 0 | Moderate: 0
==================================================
✅ SCA POLICY PASSED: All dependencies within acceptable risk thresholds.

Day 1 Key Learnings & Outcomes

Understood Software Composition Analysis (SCA) principles and how transitive dependencies introduce CVEs into production.
Audited vulnerable-store-api using native npm audit JSON outputs and cross-platform Trivy filesystem scans.
Authored an automated Node.js CI policy gate (scripts/sca-gate.js) with zero-critical and zero-high blocking thresholds.
Safely upgraded pinned package versions and verified compliant green exit-code status.

🧠 Knowledge Check

Why is relying strictly on semantic version carats (e.g. ^4.17.1) in production package manifests considered a supply-chain security risk?

Next: Day 2 — SAST & Secrets Detection →