dependencies

name	dependencies
description	This skill should be used when reviewing dependency changes, lock files, or package additions.
user-invocable	false
allowed-tools	Read, Grep, Glob

Dependencies Patterns

Domain expertise for dependency management and security analysis. Use alongside devflow:review-methodology for complete dependency reviews.

Iron Law

EVERY DEPENDENCY IS AN ATTACK SURFACE

Each package you add is code you didn't write but must trust. Minimize dependencies. Pin versions. Audit regularly. A single compromised transitive dependency can compromise your entire application. "It's a popular package" is not a security review.

---

Dependency Categories

1. Security Vulnerabilities

Known CVEs, vulnerable version ranges, malicious packages.

Violation: Wide version range includes vulnerable versions

{ "lodash": "^4.0.0" }  // Includes vulnerable 4.17.0-4.17.20

Correct: Pin to safe version

{ "lodash": "^4.17.21" }  // First safe version

2. Version Management

Unpinned versions, missing lockfiles, dependency conflicts.

Violation: Unpinned allows any version

{ "express": "*", "lodash": "latest" }

Correct: Pin with lockfile

{ "express": "^4.18.2" }  // + committed lockfile

3. Dependency Health

Outdated packages, unused dependencies, unnecessary heavy packages.

Violation: Heavy dependency for simple task

{ "moment": "^2.29.4" }  // 300KB for date formatting

Correct: Use native or lighter alternative

new Date().toLocaleDateString();  // Native

4. License Issues

Incompatible licenses (GPL in MIT project), missing licenses.

Violation: GPL in proprietary code

# GPL-3.0: some-package  # Requires your code to be GPL too!

Correct: Use permissive licenses only

npx license-checker --failOn "GPL-3.0;AGPL-3.0"

5. Supply Chain Risks

Deep transitive dependencies, unmaintained packages, typosquatting.

Violation: Typosquatted package

{ "loadsh": "1.0.0" }  // Typosquat of "lodash"

Correct: Verify package authenticity

npm view loadsh  # Check downloads, repo, maintainers

---

Extended References

For extended examples and detection commands, see:

• references/violations.md - Extended violation examples by category
• references/patterns.md - Correct dependency management patterns
• references/detection.md - Detection commands and CI integration

---

Severity Guidelines

Severity	Indicators
CRITICAL	Known exploited CVEs (CISA KEV), confirmed malicious packages, typosquats
HIGH	High severity CVEs, unmaintained packages, GPL in proprietary code
MEDIUM	Medium CVEs, significantly outdated, wide version ranges, missing lockfile
LOW	Unused dependencies, lighter alternatives available, minor version behind

---

Dependency Review Checklist

Before approving dependency changes:

• No known CVEs in added packages
• Version ranges appropriate (not too wide)
• Lockfile updated and committed
• Package actively maintained
• License compatible
• Package from verified publisher
• Transitive dependencies reviewed
• Package name verified (not typosquat)
• Bundle size impact considered
• Native alternatives considered

---

Common Vulnerability Sources

Registry	URL
npm Advisory	https://www.npmjs.com/advisories
Snyk Vuln DB	https://snyk.io/vuln
GitHub Advisory	https://github.com/advisories
NVD	https://nvd.nist.gov/
CISA KEV	https://www.cisa.gov/known-exploited-vulnerabilities-catalog