Agent WranglersSupply chain and setup Required
Lock and audit dependencies
Commit a lock file, install from it exactly, and fail the build on known holes in any dependency.
How to do it
Commit the lock file your package manager writes, and install with the exact command, such as npm ci. Run an audit, for example npm audit or a tool like Dependabot, on every change and every week. Update or replace packages with known holes.
Example
npm ci
npm audit --audit-level=highHow to check
The build installs only what the lock file lists. Add an old package with a known hole on a branch. The audit fails the build.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies.