Belajar Security Tester - Testing Third-Party Dependencies

#Pendahuluan

Setelah di episode 16 kita membahas shift-left security, pada episode ini kita mendalami attack surface yang semakin besar: third-party dependencies. Aplikasi modern menggunakan ratusan dependencies, dan satu vulnerability di dependency bisa membocorkan seluruh aplikasi.

#Software Composition Analysis (SCA)

#npm Audit

bash

# Scan dependencies untuk vulnerability
npm audit
 
# Scan dengan output JSON
npm audit --json
 
# Fix vulnerabilities
npm audit fix
 
# Fix dengan force (breaking changes)
npm audit fix --force

#Snyk

bash

# Test dependencies
snyk test
 
# Monitor untuk vulnerability baru
snyk monitor
 
# Test specific file
snyk test --file=package.json

#Trivy (Filesystem Scan)

bash

# Scan filesystem untuk vulnerabilities
trivy fs --security-checks vuln .
 
# Scan dengan severity filter
trivy fs --severity HIGH,CRITICAL .

#Licensing Risks

bash

# Cek licenses semua dependencies
npx license-checker --summary
 
# Cek restrictive licenses
npx license-checker --failOn "GPL-3.0;AGPL-3.0"
 
# Cek dengan Snyk
snyk test --licenses

#License Risk Matrix

License	Risk	Action
MIT, BSD, Apache	Low	Accept
LGPL	Medium	Review usage
GPL, AGPL	High	Legal review required
Custom/Proprietary	High	Legal review required

#Supply Chain Attacks

#Dependency Confusion

bash

# Cek apakah namespace protected
# npm: cek apakah package name di registry publik
npm view internal-package-name 2>/dev/null
 
# PyPI: cek apakah package name ada
pip install internal-package --dry-run

#Typosquatting

bash

# Cek package name similarity
# Contoh: express vs expresss (typo)
npm view expresss 2>/dev/null

#Lockfile Integrity

bash

# Cek lockfile integrity
npm ci  # Install dari lockfile
 
# Cek perubahan lockfile
git diff package-lock.json

#Secure Dependency Management

#Dependabot/Renovate

yaml

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10

#Pinning Dependencies

json

{
  "dependencies": {
    "express": "4.18.2"  // Exact version
  }
}

Warning

Jangan pernah install dependencies dari source yang tidak terverifikasi. Selalu gunakan package manager resmi (npm, pip) dan verifikasi checksum.

#Praktik: Dependency Audit

bash

# 1. npm audit
npm audit --json | grep -c '"severity"'
 
# 2. License check
npx license-checker --summary
 
# 3. Trivy filesystem scan
trivy fs --severity HIGH,CRITICAL .
 
# 4. Cek lockfile integrity
npm ci

#Penutup

SCA scanning: npm audit, Snyk, Trivy — scan setiap dependency.
Licensing: hindari GPL/AGPL tanpa legal review.
Supply chain: dependency confusion, typosquatting, lockfile integrity.
Management: Dependabot/Renovate untuk auto-update, pin versions.

Di episode 18 selanjutnya kita akan membahas network security testing basics — service scanning, TLS testing, open ports, dan network assessment. Sampai jumpa di episode 18!