Dependency vulnerability scanning enabled
Why it matters
Known vulnerabilities in dependencies are one of the most reliable attack paths for automated exploitation. CWE-1357 (Reliance on Insufficiently Trustworthy Component) and OWASP A06 (Vulnerable and Outdated Components) document that unpatched CVEs are commonly exploited within days of public disclosure. NIST 800-53 SA-10 and SSDF PW.4 both require regular assessment of component security. Projects without automated scanning may not discover a critical CVE in a transitive dependency until a breach occurs. Dependabot or npm audit in CI catches these before they ship to production.
Severity rationale
Low because vulnerability scanning prevents exploitation of known CVEs — the risk is low only when scanning runs continuously; without it, the effective severity of any undetected CVE is unbounded.
Remediation
Add Dependabot and an npm audit gate to your CI pipeline:
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: npm
directory: /
schedule:
interval: weekly
# .github/workflows/ci.yml
- name: Audit dependencies
run: npm audit --audit-level=high
Merge Dependabot PRs for high/critical CVEs within 72 hours. For false positives or dev-only dependencies, use .npmrc audit-level overrides, not blanket suppression.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Security Hardening Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- cwe · CWE-1357 — Reliance on Insufficiently Trustworthy Component
- owasp:2021 · A06 — Vulnerable and Outdated Components
- nist:rev5 · SA-10 — Developer Configuration Management
- ssdf:800-218 · PW.4 — Reuse Existing, Well-Secured Software
- soc2:2017 · CC4 — Monitoring Activities
- soc2:2017 · CC7.1 — Detection and monitoring of configuration changes and vulnerabilities
Taxons
History
- 2026-04-18·v1.0.0·Initial import from security-hardening·automated
- 2026-07-06·v1.0.1·Add SOC 2 TSC mapping (CC4, CC7.1) from the verified compliance crosswalk register (docs/compliance/).·by soc2-mapping-enrichment-ship-2