External scripts use Subresource Integrity hashes

When your app loads scripts from a CDN without Subresource Integrity hashes, you're trusting that the CDN will always serve exactly the file you expect. CDN compromises happen — an attacker who gains write access to a CDN bucket, a package registry, or a DNS record can replace jquery.min.js with a version that exfiltrates every form field on your page. OWASP A08 (Software and Data Integrity Failures) covers this supply chain vector directly. SLSA Level 2 requires artifact integrity verification. CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-494 (Download of Code Without Integrity Check) both map to external scripts without SRI.

Add integrity and crossorigin attributes to every external <script> and <link rel="stylesheet"> tag. Generate the hash from the exact file version you're pinning.

<script
  src="https://cdn.example.com/lib.min.js"
  integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8w"
  crossorigin="anonymous">
</script>

Generate hashes at https://www.srihash.org/ or via shasum -a 384 lib.min.js | xxd -r -p | base64. The long-term fix is to bundle external dependencies rather than loading them from CDNs — then SRI is moot because the asset is yours.