Your package.json Is a Shopping List You Never Audit: Fixing Supply Chain Hygiene on a Budget

Every few months, another package goes sideways and the same scene plays out in Slack channels from Manchester to Bristol: someone posts the blog link, someone else says "we use that, don't we?", and a poor soul spends their evening grepping a lockfile.

The uncomfortable truth is that most small and medium-sized UK software teams don't have a security function. They have a lead developer who also handles onboarding, procurement, and occasionally the office printer. If that's your situation, this one's for you. You don't need a SOC team — you need a habit.

What the incidents actually taught us

Strip away the drama and the big supply-chain failures — typosquatted PyPI packages, a compromised maintainer account pushing a poisoned release, the ghost of left-pad's ecosystem fragility — all point at the same three weaknesses:

1. We install faster than we think. npm install some-clever-thing takes four seconds. Evaluating it takes four hours, so nobody does it.
2. We trust versions we never pinned. A loose semver range means a compromise upstream becomes a compromise on your next CI run.
3. We have no idea what we're running. Ask a typical team how many transitive dependencies are in their frontend build and you'll get a shrug. It's often north of a thousand.

None of these require sophisticated attackers. They just require us to be busy, which we reliably are.

The Friday afternoon audit

Block two hours, once a quarter. Seriously, put it in the calendar like a dentist appointment. Here's the checklist:

• Run an audit tool, but read the output. npm audit and pip-audit are free and mostly noise. The value isn't the tool — it's the hour you spend triaging what it finds. Anything with a known exploit gets fixed or worked around that day. Everything else goes on a list.
• Check for dead packages. If a dependency hasn't been updated in three years and the maintainer's GitHub is a graveyard, that's not stability — that's abandonment. Flag it for replacement or, better, absorption.
• Hunt the duplicated purpose. Three date libraries, two HTTP clients, one moment of shame. Every redundant package is surface area you're maintaining for free.
• Verify the lockfile is committed and honoured. If your CI does a bare npm install instead of npm ci, your builds aren't reproducible and your lockfile is decorative.

Pin, but not fanatically

Lockfiles solve most of the problem. For genuinely critical dependencies — your framework, your auth library, anything touching payments — consider pinning exact versions and upgrading deliberately, on your schedule, with a changelog open. The trade-off is real: you'll miss some patches. But you'll also never get a surprise 3am release you didn't choose.

For the long tail of small utilities, a lockfile plus automated update PRs (Dependabot or Renovate, both free) is plenty. Let the robots bump the boring stuff; review the diffs like you'd review a junior's PR.

To vendor or not to vendor

Vendoring — copying third-party code into your own repo — gets a bad reputation, and mostly deserved. You inherit the maintenance burden forever, and your diff history becomes unreadable.

But there are two cases where it's the right call for a small team:

• The package is small, stable, and business-critical. A 200-line utility that your payment flow depends on? Copy it in, credit the licence, own it. You've removed an entire class of supply-chain risk for the cost of occasional maintenance.
• The package is abandoned but load-bearing. If nobody's home upstream and you need it to keep working, forking (or vendoring) beats praying.

Everything else: trust the registry, but verify what you've trusted. Check the package name character by character on first install — typosquats live and die on that one moment of carelessness.

Make it someone's job (it's two hours a quarter)

The reason supply-chain hygiene fails at SMEs isn't ignorance — it's that nobody owns it. Assign it. Rotate it if you like. Two hours a quarter, the checklist above, and a running doc of decisions. That's the whole system.

Your future self, sipping tea on the day the next big incident lands, will be very grateful.