What is software supply-chain risk and how do you mitigate it?

Deep dive

Supply-chain attacks target dependencies and build pipelines:

• Risks: typosquatting, compromised packages, poisoned build steps.
• Controls: lockfiles, provenance (SLSA), signed artifacts (Sigstore).
• CI hardening: least-privilege tokens, isolated build runners.
• Continuous scanning: SCA, SBOM, dependency policies.

Examples

Dependency integrity via lockfile + CI verification:

- npm ci (uses lockfile)
- verify package signatures
- fail build on critical CVEs

Common pitfalls

• Auto-updating dependencies without review.
• Using shared CI secrets across repos.
• Skipping SBOMs or dependency audits.

Interview follow-ups

• How do you respond to a compromised dependency?
• What is SLSA level 2/3 in practice?
• How do you ensure build reproducibility?