Supply chain dependency reviews
Find every artifact that contains the reported package
A dependency incident starts with exposure mapping. Determine where the code ran and which credentials or data were available before choosing the recovery action.
In this article
Confirm the advisory and affected versions
Use the package's official advisory or a trusted vulnerability record and identify the exact affected package and version range. Distinguish a vulnerability report from a confirmed malicious release.
Match the report against resolved inventories for deployed artifacts and build environments. A top-level manifest search can miss a transitive dependency or an older release still running elsewhere.
Record uncertainty explicitly when an inventory is missing. Do not infer absence from a scanner that does not cover the relevant ecosystem.
Contain the relevant execution path
For an exploitable runtime issue, apply the approved containment or patch plan based on the affected feature. For suspected malicious build code, assess CI credentials, network reach and produced artifacts as well.
Pause affected builds or promotions when necessary under the incident process. Preserve logs and artifact identities before replacing ephemeral environments.
Rolling back code may reduce ongoing execution, but it does not revoke credentials already exposed. Coordinate credential rotation and access review with the responsible incident owner when evidence warrants them.
Produce and verify the replacement
Update or remove the affected dependency through a reviewed graph change. Use the controlled build path and run tests focused on the application's use of that component.
Promote the identified replacement artifact and verify the running version. Reconcile every affected deployment rather than assuming the primary service was the only consumer.
For a synthetic example, a document parser appears in both an upload API and a scheduled import worker. Fixing only the API leaves the same vulnerable input path active in the worker.
Close the inventory and process gaps
Record affected artifacts, containment, replacement and any remaining exceptions. Preserve the evidence needed for the incident review without distributing secrets or malicious payloads unnecessarily.
Add missing inventory coverage and dependency-specific fixtures discovered during the response. Review whether build jobs had more authority than they needed.
The incident is not resolved merely because the latest lockfile looks correct. The relevant code paths and environments must be replaced or otherwise controlled, with residual uncertainty assigned to an owner.
Primary sources
OWASP: vulnerable dependency managementReferences checked 11 September 2026.