---
name: dependencies-and-supply-chain
description: Review packages, lockfiles, scripts, provenance, licensing, advisories, and dependency risk.
---

# Dependencies and Supply Chain

Check direct and transitive dependencies, versions, lockfiles, install scripts, abandoned packages, advisories, typosquatting signals, permissions, licenses, and update paths. Prioritize reachable vulnerable code and verify fixes with reproducible installs.