Skip to content

Dependencies, packages and the supply chain

How code gets built and shipped

Reading 1 of 5

Nobody writes it all

Developers do not build date handling, image resizing or payment forms from scratch. They install a package: a reusable piece of code published by someone else.

A typical modern web app installs a few dozen packages directly. Those packages install packages of their own, and so on. The real total is routinely over a thousand.

  1. Your coderoughly 2 percent
  2. Packages you chosea few dozen
  3. Packages those pulled inoften over a thousand

Most vulnerabilities live in the bottom band, which nobody picked.

You wrote a fraction of your product. Strangers wrote the rest.