Supply chain and dependency security
Comes up in: Web fundamentals, Hiring manager
This concept is being written. It gets the full five steps — explanation, predict, interview angle, practice with tests, and review cards. Here is exactly what it will cover, so you can study it elsewhere in the meantime.
What it covers
- malicious/compromised packages (cite real incidents with dates, e.g. event-stream 2018, the 2025 npm worm incidents — facts)
- lockfiles
npm audit- provenance and Sigstore
- Subresource Integrity for CDN scripts
- minimal dependencies
- install-script risks
Words you will know
What you will practise
- add SRI and dependency policy to a project
Interview questions this answers
- How do you protect a frontend from compromised npm packages?
- What is Subresource Integrity?