Transitive Dependency Confusion:
How SCA Tools Miss the Real Risk

# Don't trust package.json. Check what's actually installed:
npm ls lodash

# Example output showing version conflict:
[email protected]
├─┬ [email protected]
│ └── [email protected]  # ← not the version you pinned!
└── [email protected]   # your direct dep, correct

# Check which version code actually imports at runtime:
node -e "console.log(require('lodash/package.json').version)"
# May output 4.17.20 depending on resolution order

# List ALL installed versions of a package across the tree:
npm ls --all | grep lodash

# See the full flattened dependency tree (can be thousands of lines):
npm ls --all --json | jq '.dependencies | keys'

# Show every installation of axios and its version
npm ls axios --all

# More complete: search node_modules directly
find node_modules -name "package.json" -path "*/axios/package.json" \
  -exec grep -H '"version"' {} \;

# With jq — get package name + version for all installed packages
find node_modules -name "package.json" -not -path "*/node_modules/*/node_modules/*" \
  | xargs jq -r '[.name, .version] | @tsv' 2>/dev/null \
  | sort | uniq

# Then cross-reference against a known-bad version list
find node_modules -name "package.json" -not -path "*/node_modules/*/node_modules/*" \
  | xargs jq -r '[.name, .version] | @tsv' 2>/dev/null \
  | grep -E 'axios\t0\.(19|20|21)\.'  # CVE range

# Audit package-lock.json for specific CVE-affected versions
# This finds lodash < 4.17.12 in the lockfile
node -e "
const lock = require('./package-lock.json');

function findVulnerable(deps, parentPath = '') {
  if (!deps) return;
  for (const [name, info] of Object.entries(deps)) {
    const fullPath = parentPath ? parentPath + ' > ' + name : name;
    if (name === 'lodash') {
      const v = info.version.split('.').map(Number);
      const vulnerable = v[0] === 4 && v[1] === 17 && v[2] < 12;
      if (vulnerable) console.log('VULNERABLE:', fullPath, info.version);
    }
    findVulnerable(info.dependencies, fullPath);
  }
}

findVulnerable(lock.dependencies);
"

# Or use npm ls to show the dependency path to a specific package
npm ls lodash@'<4.17.12'  # shows all instances below the patched version

# VULNERABLE: internal packages can be confused with public ones
# This config falls back to public npm for any package
registry=https://npm.pkg.github.com/your-org
# No scoped registry — so @your-org/internal-lib might resolve from public npm

# SAFER: scope your private packages with a namespace
# and point that scope exclusively at your private registry
@your-org:registry=https://npm.pkg.github.com/your-org
always-auth=true

# For other packages, use public npm
# The scope prevents confusion — public npm has no @your-org packages

# ALSO: check your package.json for unscoped internal package names
# If you have "internal-auth-lib" (no scope), it can be confused
# Always use "@your-org/internal-auth-lib" for private packages

# Step 1: npm audit — lockfile-aware, covers transitive deps
npm audit --json | jq '.vulnerabilities | to_entries[] |
  select(.value.severity == "high" or .value.severity == "critical") |
  {name: .key, severity: .value.severity, via: .value.via}'

# Step 2: Force a clean install and re-audit
# (catches cases where lockfile and node_modules are out of sync)
rm -rf node_modules
npm ci  # install exactly from lockfile
npm audit

# Step 3: Check for multiple installed copies of the same package
npm ls --all --json | python3 -c "
import json, sys
tree = json.load(sys.stdin)

def collect_versions(deps, result={}):
    for name, info in (deps or {}).items():
        result.setdefault(name, set()).add(info.get('version', 'unknown'))
        collect_versions(info.get('dependencies'), result)
    return result

versions = collect_versions(tree.get('dependencies', {}))
dupes = {k: sorted(v) for k, v in versions.items() if len(v) > 1}
for pkg, vers in sorted(dupes.items()):
    print(f'{pkg}: {vers}')
"

# Step 4: OWASP Dependency-Check for comprehensive CVE matching
docker run --rm \
  -v $(pwd):/src \
  -v $(pwd)/odc-reports:/report \
  owasp/dependency-check \
  --project "my-app" \
  --scan /src \
  --format JSON \
  --out /report

name: SCA — Full Dependency Audit
on: [push, pull_request]

jobs:
  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dependencies (from lockfile)
        run: npm ci

      - name: npm audit (transitive-aware)
        run: npm audit --audit-level=high
        # fails build on high/critical in ANY package, transitive included

      - name: Check for duplicate package versions
        run: |
          npm ls --all 2>&1 | grep -E 'WARN.*invalid|deduped' || true
          # Flag any packages with multiple installed versions

      - name: Snyk — deep transitive scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --all-projects --severity-threshold=high

# requirements.txt — what most teams have
django>=4.0
requests>=2.28
celery>=5.0

# Problem: running pip install at different times gives different versions
# of these packages AND their transitive deps (urllib3, certifi, kombu, etc)

# What you actually need: pip freeze output as requirements-lock.txt
pip freeze > requirements-lock.txt

# Install from the lock:
pip install -r requirements-lock.txt

# Better: use pip-tools
pip install pip-tools
pip-compile requirements.in        # generates requirements.txt with all transitive deps pinned
pip-sync requirements.txt          # installs exactly those versions

# Or use Poetry which has a proper lockfile
poetry add django requests celery  # creates poetry.lock with full transitive tree
poetry install --no-root           # installs exactly from lockfile

# pip-audit — lockfile-aware Python CVE scanner
pip install pip-audit

# Audit current environment (all installed packages, including transitive)
pip-audit

# Audit from a requirements file
pip-audit -r requirements.txt

# Audit with OSV (Open Source Vulnerabilities) database
pip-audit --vulnerability-service osv -r requirements.txt

# Show full dependency path to vulnerable package
pip-audit --desc=on -r requirements.txt

# Safety — alternative tool
pip install safety
safety check --full-report

{
  "overrides": {
    // Force lodash to safe version everywhere in the tree
    "lodash": ">=4.17.21",
    // Force follow-redirects to safe version (axios SSRF fix)
    "follow-redirects": ">=1.15.4",
    // Nested override: only for axios's follow-redirects dep
    "axios": {
      "follow-redirects": ">=1.15.4"
    }
  }
}