sap-dependency-security

# SAP Dependency Security ## Related Skills - **sap-hana-cli**: For dependency-aware database tooling workflows and upgrade guidance - **sap-cap-capire**: For CAP dependency-safe runtime and service configuration guidance - **sap-fiori-tools**: For secure UI5/Fiori dependency strategy when tooling touches frontend packages - **sapui5**: For SAPUI5/OpenUI5 frontend dependency and MCP tooling review - **sap-datasphere**: For tenant-connected Datasphere MCP and CLI dependency review - **sap-sac-scripting**: For source-pinned SAC MCP setup and local install records Manage SAP dependency security and upgrades with supply chain protection, compatibility analysis, staged rollout, and comprehensive testing across all major package managers. ## When to Use This Skill - Upgrading major framework or library versions - Configuring supply chain attack prevention (cooldown, script blocking, lockfile hardening) - Setting up secure package manager configuration - Resolving dependency conflicts or peer dependency issues - Planning incremental upgrade paths with testing - Automating dependency updates with Renovate, Dependabot, or Snyk - Auditing dependencies for vulnerabilities - Setting up CI/CD dependency security workflows - Pinning or reviewing SAP MCP servers in `.mcp.json` - Reviewing SAP CAP, UI5/Fiori, HANA, Datasphere, SAC, SAP Cloud SDK, BTP/CF/mbt, or ABAP/gCTS dependency workflows ## Common Issues | Issue | Recommended response | |-------|----------------------| | Floating MCP package or `@latest` in `.mcp.json` | Replace with an exact version or approved source commit and run `npm run validate:mcp-security`. | | Lockfile changed unexpectedly | Review package manager config, block lifecycle scripts, and regenerate only after dependency intent is clear. | | Dependency is too new for cooldown policy | Hold the upgrade unless a documented security exception justifies immediate adoption. | | Tenant-connected tool changed source | Verify the source URL, commit, and build steps before using credentials. | ## Two Modes of Operation **Interactive** — Walk through setup questions to generate tailored config. Use for fresh setup. **Default** — Apply recommended defaults immediately: 7-day cooldown, block all scripts, frozen-lockfile, lockfile-lint, Dependabot with cooldown. Customization optional. **SAP Development Mode** — Use a stricter SAP posture: 14-day cooldown, exact pins for MCP servers and executable tooling, no floating `@latest`, source commit pins for local MCP servers, and manual review for tenant-connected tools. ## SAP Development Mode Use SAP Development Mode when dependency work touches SAP projects, SAP BTP deployment tooling, SAP SDKs, or any MCP server shipped by this repository. Core rules: 1. **Default to 14-day cooldown** for SAP enterprise projects. Record explicit exceptions in the SAP MCP inventory or project review notes. 2. **Treat MCP servers as executable dependencies**. In `.mcp.json`, use exact npm pins such as `@ui5/mcp-server@0.2.11`, never `@latest` or bare package names. 3. **Pin local-source MCPs by commit**. SAC uses the trusted `secondsky/sap_analytics_cloud_mcp` fork and must record commit `2020235505d98111c2889598ab2217c1619b6943`. 4. **Keep runtime authorization separate**. This skill covers package/source/executable trust; use the relevant SAP skill for tenant role design and business authorization. 5. **Validate MCP drift** with `npm run validate:mcp-security` after any `.mcp.json` or SAP MCP inventory change. Load `references/sap-dependency-risk-matrix.md` for SAP stack coverage and `references/sap-mcp-security.md` for MCP update workflow and SAC source-install policy. Use `references/sap-mcp-inventory.json` as the machine-readable approved MCP package/source list. ## Interactive Setup Flow When the user wants tailored configuration, walk through these decisions. Skip this section entirely if using default mode. ### Tier 1: Required Decisions Always ask these 3 questions before generating any config: **1. Package Manager** "Which package manager does this project use?" | Answer | Generates | |--------|-----------| | npm | `.npmrc` | | Bun | `bunfig.toml` | | pnpm | `pnpm-workspace.yaml` | | Yarn | `.yarnrc.yml` | | Deno | `deno.json` config | **2. Cooldown Period** "How many days should newly published packages age before install? This prevents supply chain attacks where malicious packages are discovered and unpublished within days." | Option | Days | Use Case | |--------|------|----------| | Aggressive | 3 | Catches most typosquatting | | Recommended | 7 | Good balance for most projects | | Conservative | 14 | Critical/production systems | | Paranoid | 21 | Matches Snyk's built-in default | | Custom | N | User specifies | **3. Post-Install Script Policy** "How should lifecycle scripts (postinstall, preinstall) be handled? These are the #1 attack vector for supply chain attacks." | Option | Behavior | |--------|----------| | Block all (recommended) | `--ignore-scripts` + allow-git=none | | Allowlist | Block by default, allow specific trusted packages | | Review only | Warn but don't block | ### Tier 2: Security Tooling (Offer as Batch) "Which of these security features would you like to configure? Select any that apply." **4. CI/CD Automation Tool** | Answer | Generates | |--------|-----------| | Dependabot | `.github/dependabot.yml` with cooldown | | Renovate | `renovate.json` with minimumReleaseAge | | Snyk | No config needed (21-day cooldown built-in) | | None | Skip | **5. Automerge Policy** | Option | Behavior | |--------|----------| | None | All updates require manual review | | Minor+Patch only | Auto-merge safe updates, review majors | | All with approval | Auto-merge after team approval | **6. Update Schedule** | Option | Config Value | |--------|-------------| | Daily | `"daily"` | | Weekly (default) | `"weekly"` | | Biweekly | `"biweekly"` | | Monthly | `"monthly"` | **7. Install-Time Security Tooling** "Which security tools should protect dependency installation?" | Option | Free? | What It Does | |--------|-------|-------------| | socket npm wrapper | Yes (beta) | Wraps npm/npx, blocks malicious packages before install. Run `socket wrapper on` to enable system-wide. | | npq | Yes | Pre-install auditor (CVE, typosquat, age, provenance checks) | | Socket Firewall (sfw) | No | Real-time deep analysis, blocks malicious packages | | socket npm + npq | Yes | Both free tools combined | | None | — | Skip | Load `references/socket-cli-guide.md` for full Socket CLI setup including authentication and free vs authenticated features. **8. Lockfile Validation** | Option | Behavior | |--------|----------| | Yes (recommended) | Adds `lockfile-lint` + CI script | | No | Skip | ### Tier 3: Advanced Options (Only If User Opts In) "Would you like to configure any advanced options?" **9. Dev Containers** — Generate hardened `.devcontainer/devcontainer.json` (Yes/No) **10. Secrets Manager** — 1Password CLI / Infisical / None **11. pnpm Trust Policy** — Enable `trustPolicy: no-downgrade` (pnpm 10.21+ only, Yes/No) **12. Cooldown Exclusions** — Package names that bypass cooldown (e.g., `@types/react`, `typescript`, `esbuild`) ## Security-First Upgrade Principles 1. **Cooldown before installing** — Wait 7 days for general projects or 14 days for SAP enterprise/MCP workflows so new package versions are vetted by the community 2. **Block post-install scripts** — Prevent arbitrary code execution during `npm install` 3. **Freeze lockfiles in CI** — Use deterministic installs (`npm ci`, `--frozen-lockfile`) 4. **Validate lockfile integrity** — Use `lockfile-lint` to detect injection 5. **Audit before trusting** — Use `npq` or Socket CLI to check packages before installing 6. **Upgrade incrementally** — One major version at a time with testing between each 7. **Never blindly upgrade** — Avoid `npm update` or `npm-check-updates -u` without review 8. **Scan before and after** — Use `socket scan` to detect supply chain issues beyond CVEs 9. **Pin SAP MCP executables** — Use exact npm versions or source commit pins before letting MCP servers access SAP projects or tenants ## Cooldown Period: Prevent Supply Chain Attacks Newly published packages may contain malicious code discovered within hours. Configure a cooldown period to delay installation. ### Quick Setup **npm** (`.npmrc`): ```ini min-release-age=7 ``` **Bun** (`bunfig.toml`): ```toml [install] minimumReleaseAge = 604800 # 7 days in seconds minimumReleaseAgeExcludes = ["@types/bun", "typescript"] ``` **pnpm** (`pnpm-workspace.yaml`): ```yaml minimumReleaseAge: 10080 # 7 days in minutes minimumReleaseAgeExclude: - '@types/react' - typescript ``` **Yarn** (`.yarnrc.yml`): ```yaml npmMinimalAgeGate: "7d" npmPreapprovedPackages: - "@types/react" - "typescript" ``` Load `references/cooldown-config-guide.md` for detailed per-PM configuration, CI tool integration, and exclusion patterns. Use `templates/<pm>-security.tmpl` for copy-paste ready config files. ## Disable Post-Install Scripts Post-install scripts are the most common supply chain attack vector (Shai-Hulud, Nx, event-stream incidents). ### Quick Setup **npm**: ```bash npm config set ignore-scripts true npm config set allow-git none ``` **Bun**: Disabled by default. Allow specific packages in `package.json`: ```json { "trustedDependencies": ["esbuild", "sharp"] } ``` **pnpm (10.0+)**: Disabled by default. Allow specific packages in `pnpm-workspace.yaml`: ```yaml allowBuilds: esbuild: true strictDepBuilds: true # Hard error on unreviewed scripts ``` Load `references/package-manager-security.md` for full per-PM hardening including pnpm `trustPolicy`, `blockExoticSubdeps`, and `@lavamoat/allow-scripts`. ## Deterministic & Frozen Installs Always use frozen install commands in CI to ensure reproducible builds: | Package Manager | Command | What It Does | |----------------|---------|-------------| | npm | `npm ci` | Deletes node_modules, installs exact lockfile versions | | Bun | `bun install --frozen-lockfile` | Fails if lockfile is out of sync | | pnpm | `pnpm install --frozen-lockfile` | Fails if lockfile is out of sync | | Yarn | `yarn install --immutable --immutable-cache` | Validates lockfile and cache | | Deno | `deno install --frozen` | Frozen installation | Commit all lockfiles to version control: `package-lock.json`, `bun.lock`, `pnpm-lock.yaml`, `yarn.lock`, `deno.lock`. ## Lockfile Validation Install and configure `lockfile-lint` to detect lockfile injection attacks: ```bash npm install --save-dev lockfile-lint ``` ```json { "scripts": { "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --allowed-hosts npm --validate-https", "preinstall": "npm run lint:lockfile" } } ``` Note: `lockfile-lint` does not currently support Bun's `bun.lock` / `bun.lockb` formats. ## Pre-Install Security Auditing ### npq — Pre-Install Auditor ```bash npm install -g npq npq install <package> # Audit before installing npq install <package> --dry-run # Audit without installing # Shell alias for seamless use alias npm='npq-hero' # Use with other PMs NPQ_PKG_MGR=pnpm npq install <package> NPQ_PKG_MGR=bun npq install <package> ``` ### Socket Firewall (sfw) — Real-Time Blocker ```bash npm install -g sfw sfw npm install <package> # Blocks malicious packages sfw pnpm add <package> sfw yarn add <package> ``` Load `references/supply-chain-security.md` for full comparison of npq vs sfw and what each validates. ## Socket CLI Integration Socket CLI provides proactive supply chain security beyond basic vulnerability scanning — covering malware detection, typosquatting, protestware, install script risks, and license compliance. ### Proactive Upgrade Workflow ``` 1. PRE-UPGRADE: socket scan create --report → establish baseline 2. EVALUATE: socket package score npm <pkg>@<ver> → assess target package safety 3. SAFE INSTALL: socket npm install <pkg> → block malicious packages 4. POST-UPGRADE: socket scan create --report → verify no new alerts 5. DIFF: socket scan diff <before> <after> → see exactly what changed 6. FIX: socket fix --minimum-release-age 7d → auto-fix any new CVEs 7. OPTIMIZE: socket optimize → apply security overrides ``` ### Quick Reference ```bash # Install npm install -g socket # Authenticate (required for scans, fixes, package scores) socket login # Check a package before upgrading socket package score npm <package> # Scan your whole project socket scan create --report # Auto-fix CVEs (complements Dependabot/Renovate) socket fix --minimum-release-age 7d # Gate CI on security policy socket ci # Safe npm wrapper (free, no auth needed) socket wrapper on ``` Load `references/socket-cli-guide.md` for comprehensive command reference, CI workflow templates, alert categories, and free vs authenticated feature matrix. ## Dependency Analysis ```bash # Audit for vulnerabilities bun audit # Bun npm audit # npm yarn audit # Yarn # Socket: deep security assessment (CVEs + supply chain + license) socket package score npm <package> socket scan create --report # Check for outdated packages bun outdated npm outdated # Interactive upgrade (safe — review each) bunx npm-check-updates --interactive # Analyze dependency tree npm ls <package-name> yarn why <package-name> ``` ## Staged Upgrade Strategy Upgrade one dependency at a time with testing between each: ```bash # 1. Create feature branch git checkout -b upgrade/<package>-<version> # 2. (Optional) Baseline scan — capture current state socket scan create --report # 3. Evaluate target package before upgrading socket package score npm <package>@<version> # 4. Upgrade single package bun add <package>@<version> # 5. Test immediately bun test && bunx tsc --noEmit && bun run build # 6. (Optional) Post-upgrade scan — verify no new alerts socket scan create --report