What are the main dependency and supply-chain risks in a Node project, and how do you reduce them?

Most of a Node app is third-party code. A vulnerable or malicious package runs with your app's full privileges.

The main risks:

• Known CVEs (publicly listed vulnerabilities) in outdated packages.
• Typosquatting: a fake package with a name like a popular one, such as expresss.
• Hijacked maintainer accounts that publish malicious versions of real packages.
• postinstall scripts that run on install and steal secrets from CI.
• Dependency confusion: the installer picks a public package that has the same name as your private one.

Defences:

• Commit the lockfile and install with npm ci, so every build uses the exact same versions.
• Run npm audit or a tool like Dependabot in CI, and patch quickly.
• Before you add a new dependency, check that it is maintained and widely used. Keep the dependency tree small.
• Use --ignore-scripts where you don't need install scripts.
• Scope private packages to your own registry.

Keep an SBOM (Software Bill of Materials: a list of every package and version you use). When the next major vulnerability is announced, it lets you answer "are we affected?" quickly.