<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: scanning-dependencies-for-vulnerabilities
description: >-
  Scan project dependencies for known CVEs using Snyk, OSV-Scanner, and Trivy.
  Automate vulnerability detection in package manifests, lock files, and transitive
  dependencies with CI/CD integration and remediation guidance.
domain: cybersecurity
subdomain: devsecops
tags:
  - sca
  - dependency-scanning
  - snyk
  - osv-scanner
  - trivy
  - cve
  - supply-chain
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Scanning Dependencies for Vulnerabilities

## Overview

Software Composition Analysis (SCA) identifies known vulnerabilities in third-party
dependencies. Modern applications consist of 80-90% open source code, making dependency
scanning critical. This skill covers scanning package manifests, lock files, and
transitive dependency trees for CVEs with automated remediation.

Mode: `[MODE: BLUE]` — Proactive vulnerability management in the software supply chain.

## Prerequisites

| Requirement | Details |
|---|---|
| Snyk CLI (`npm install -g snyk && snyk auth`) | Required |
| OSV-Scanner (`go install github.com/google/osv-scanner/cmd/osv-scanner@latest`) | Required |
| Trivy (`brew install trivy` or Docker) | Required |
| Package manifests (package.json, requirements.txt, go.mod, pom.xml) | Required |

## Key Concepts

### Snyk in GitHub Actions

```yaml
name: Dependency Scan
on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1'

jobs:
  snyk-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run Snyk
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --json-file-output=snyk-results.json
      - name: Upload results
        if: always()
        uses: actions/upload-artifact@v4
        with:
          name: snyk-results
          path: snyk-results.json
```

### OSV-Scanner

```bash
# Scan current directory recursively
osv-scanner -r .

# Scan specific lockfile
osv-scanner --lockfile=package-lock.json

# JSON output
osv-scanner -r . --format json > osv-results.json

# Scan SBOM
osv-scanner --sbom=sbom.cdx.json

# Filter by ecosystem
osv-scanner --lockfile=requirements.txt
```

### Trivy Filesystem Scan

```bash
# Scan project dependencies
trivy fs . --severity HIGH,CRITICAL --format json --output trivy-deps.json

# Scan specific lockfile
trivy fs package-lock.json --severity HIGH,CRITICAL

# Ignore unfixed vulnerabilities
trivy fs . --ignore-unfixed --severity CRITICAL
```

### Snyk CLI Commands

```bash
# Test for vulnerabilities
snyk test --severity-threshold=high --json > snyk-results.json

# Monitor project (continuous)
snyk monitor --org=my-org

# Fix vulnerabilities automatically
snyk fix

# Test specific manifest
snyk test --file=requirements.txt --severity-threshold=high

# Ignore specific vulnerability
snyk ignore --id=SNYK-JS-LODASH-590103 --reason="No user input reaches this path"
```

### Dependabot Configuration

```yaml
# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
    open-pull-requests-limit: 10
    reviewers:
      - "security-team"
    labels:
      - "dependencies"
      - "security"
    ignore:
      - dependency-name: "aws-sdk"
        update-types: ["version-update:semver-major"]
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "daily"
    open-pull-requests-limit: 5
```

## Workflow

### Step 1: Scan Dependencies

```bash
node scripts/agent.js --action scan --project-dir . --output /tmp/dep-scan.json
```

### Step 2: Check Specific Lockfile

```bash
node scripts/agent.js --action lockfile --lockfile package-lock.json --output /tmp/lockfile-scan.json
```

### Step 3: Generate Remediation Plan

```bash
node scripts/agent.js --action remediate --project-dir . --output /tmp/remediation.json
```

## Detection

```yaml
title: Scanning Dependencies For Vulnerabilities Detection
id: bbb9da39-ef5a-4511-81d4-c53873a61699
status: experimental
description: Detects suspicious activity related to scanning dependencies for vulnerabilities techniques in devsecops context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*scanning*dependencies*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.execution
falsepositives:
  - CI/CD pipeline executing authorized security scanning tools
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Scanning Dependencies For Vulnerabilities Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] SCA runs on every PR and weekly scheduled scan
- [ ] Critical CVEs block merges
- [ ] Transitive dependencies included in scans
- [ ] Dependabot or Renovate configured for auto-updates
- [ ] Vulnerability exceptions documented with risk acceptance
- [ ] License compliance checked alongside CVEs
- [ ] EPSS scores used to prioritize remediation

## References

- [Snyk Documentation](https://docs.snyk.io/)
- [OSV-Scanner](https://google.github.io/osv-scanner/)
- [Trivy Documentation](https://aquasecurity.github.io/trivy/)
- [OWASP Dependency-Check](https://owasp.org/www-project-dependency-check/)
