Day 15 - Software Composition Analysis(SCA)

Modern applications are no longer built completely from scratch.

Today’s software is heavily dependent on:

• Open-source libraries


• Third-party packages


• Public repositories


• Container images


• Framework ecosystems

A modern application may contain:

10% Custom Code

90% Open Source Dependencies

And that creates one of the biggest security risks in modern software engineering.

This is where Software Composition Analysis (SCA) becomes critical.

🔗 Resources

• ** Support the Journey on GitHub:
  If you're following along, consider starring and forking the repo:**
  
  
  
  

  The Log4Shell vulnerability changed the entire industry.

  
  
  
  
  
  

  
  
  
  ☠️ 2. Malicious Packages
  

  
  
  

  Attackers upload fake packages to public registries.

  
  
  

  Example:
  
  

  
  
  
  
  

  CODE Kopieren

  requests → safe package
  
  reqeusts → typo-squatting malicious package
  
  

  
  
  
  
  
  
  
  

  One typo can compromise systems.

  
  
  
  
  
  

  
  
  
  🕵️ 3. Supply Chain Attacks
  

  
  
  

  Instead of attacking companies directly,
  
  attackers compromise trusted dependencies.

  
  
  
  

  
  
  
  🚨 Famous Supply Chain Attacks
  

  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  
  

  Attack	Impact
  SolarWinds	Massive enterprise compromise
  Codecov	CI/CD credential theft
  event-stream npm attack	Cryptocurrency theft
  ua-parser-js compromise	Malware injection

  
  
  
  

  
  
  
  🔍 What is Dependency Scanning?
  

  
  
  

  Dependency scanning means:
  
  

  
  
  
  
  

  CODE Kopieren

  Checking all packages against vulnerability databases
  
  

  
  
  
  
  
  
  
  

  SCA tools compare dependencies with databases like:

  
  
  
  
  
  • NVD
  
  
  • CVE databases
  
  
  • GitHub Security Advisories
  
  
  • Vendor advisories
  
  
  
  
  
  
  
  

  
  
  
  🧠 Example of Dependency Scanning
  

  
  
  
  
  
  
  

  CODE Kopieren

  package.json
  
        ↓
  
  SCA Tool Scans Dependencies
  
        ↓
  
  Matches CVEs
  
        ↓
  
  Risk Report Generated
  
  

  
  
  
  
  
  
  
  
  
  
  

  
  
  
  🔄 Where SCA Fits into DevSecOps Pipeline
  

  
  
  

  SCA should happen continuously across the pipeline.