Reviewing your own code does not review everything your build installs. Third-party packages—and the transitive dependencies they bring along—are part of the software you ship, and some packages can run code during installation. Count and control the dependency graph, review updates deliberately, limit install-time behavior where practical, and keep build credentials narrowly scoped.
Why a code review cannot cover the whole build
Application code is only one part of a project’s software supply chain. A dependency can itself rely on other packages, so the complete set of components may be much larger than the list a developer selected directly. Those components can change what is present in a build, and installation may involve actions beyond copying files.
As an Amazon Associate I earn from qualifying purchases.
As Serguey Asael Shinder put it in the DEV Community article “You Read Your Code and Installed Everybody Else’s,” “Installing is not copying.” The article says packages can run code at install time on the machine doing the installing. That matters when the machine is a build agent with access to source checkouts, registry tokens, or deployment credentials. This is a practical exposure to manage, not proof that every package or build is malicious.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →CISA describes several supply-chain compromise routes: a vulnerable third-party component, malicious code introduced into a supplier’s development lifecycle, or malicious software built or deployed by a customer. Its guidance states, “Transparency into the software supply chain is necessary to manage that risk.” CISA’s software supply-chain guidance discusses open-source software management, maintenance, vulnerability response, and SBOM creation and validation.
#1 Best Overall
Make the dependency graph visible
Count direct and transitive packages
Start with the resolved dependency graph, not just the packages named in a manifest. Identify how many components are installed and which packages bring in other packages. This gives the team an inventory to examine when a vulnerability or suspicious change is reported.
Use lockfiles to make resolution deliberate
Commit and use the lockfile or the ecosystem’s equivalent version controls so that installs resolve to known versions rather than silently selecting new ones within a broad range. A lockfile improves repeatability; it does not certify that a package is trustworthy or free of vulnerabilities.
Rank #2
Review updates as changes to the product
Treat dependency updates as intentional changes: inspect what is being upgraded, consider the change in the resolved graph, and validate the result before it reaches a release. Avoid relying on unexamined version ranges to make consequential changes without review. The goal is not to freeze dependencies indefinitely—stale components can also carry risk—but to make updates visible and controlled.
Recommended Free Tools
Reduce what installation and builds can do
Disable install scripts selectively
Where the package ecosystem and project allow it, disable install-time scripts or restrict them. First identify packages that require scripts and understand what those scripts do; a blanket setting may break legitimate build or setup steps. Treat exceptions as decisions to review, not as invisible defaults.
Limit build credentials and permissions
Give build jobs only the access they need, and avoid exposing long-lived or broadly privileged credentials to jobs that install unreviewed dependencies. Separate credentials by purpose where possible, restrict their scope, and avoid granting deployment or registry access to build steps that do not need it. This follows Shinder’s argument that a build environment can be an attractive point of exposure when it holds valuable credentials; it is a risk-management recommendation, not a claim that build agents are universally the weakest part of an organization.
Use an SBOM as an inventory, not a verdict
A software bill of materials (SBOM) records components and their relationships. CISA describes it as “the emerging standard way of communicating dependencies between supplier and customer.” An SBOM can help a team understand which components are present and communicate that information, but it does not by itself establish that the software is safe.
Rank #4
Vulnerability information changes over time, so an SBOM needs to be correlated with current vulnerability data. Applicability matters too: a listed component may not be affected in a particular product or configuration. CISA’s SBOM-consumption guidance discusses dependency context, ongoing vulnerability correlation, and VEX information, which can clarify whether a vulnerability applies when such information is available.
Choose dependency tools around the work you need to do
If you evaluate dependency-management or software-composition-analysis tools, compare capabilities against your project rather than relying on a product label. Useful questions include:
Best Value
- Which package ecosystems does the tool support?
- Does it cover both direct and transitive dependencies in the resolved graph?
- How current is its vulnerability data, and how does it communicate data freshness?
- Can it import or export SBOMs in formats your suppliers and customers use?
- Does it provide applicability context, including VEX information where available?
- How does it integrate with your CI pipeline, and what operational work will ongoing alerts and exceptions create?
These are evaluation criteria, not claims about any particular vendor. The right fit depends on your ecosystems, release process, and capacity to act on findings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
