Explore Software Supply Chain Security

Your package.json lists maybe a dozen packages. Your build actually pulls in hundreds — most of them dependencies of dependencies you've never opened, never audited, and would struggle to name. That gap between what you chose and what you're running is where this topic lives.

your tutor starts by sketching your dependency graph on the whiteboard — not the top-level list, the recursive one — so you can see where a minimal app quietly accumulates 47+ transitive packages before you've written a line of logic. From there you work through how that graph gets attacked: typosquatting, dependency confusion during resolution, a maintainer account gone rogue. Then the harder half — SBOMs, Sigstore/cosign signing, SLSA provenance — not as compliance paperwork but as the only way to answer 'where did this artifact actually come from.'

This isn't a replacement for your AppSec coursework or your CI/CD training. It's the place where you stop treating your pipeline as a build tool and start treating it as the production system it already is — one with secrets, network egress, and push access to prod.