<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-third-party-code-audit
description: >-
  Perform security audits of third-party code including open-source libraries,
  vendor SDKs, and external dependencies. Assess code quality, identify
  vulnerabilities, and evaluate supply chain risk before integration.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - code-audit
  - third-party-security
  - vendor-assessment
  - open-source-audit
  - static-analysis
  - dependency-review
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Performing Third Party Code Audit

## Overview

Third-party code audits assess the security posture of external dependencies
before they enter your software supply chain. This goes beyond automated scanning
to include manual code review of critical paths, architecture analysis, build
process verification, and maintainer trust assessment. The goal is informed risk
acceptance with documented compensating controls.

Mode: `[MODE: RED]` — Audit third-party code for vulnerabilities and supply chain risks.

## Prerequisites

| Requirement | Details |
|---|---|
| semgrep for static analysis | Required |
| Bandit for Python security scanning (`pip install bandit`) | Required |
| ESLint with security plugins for JavaScript | Required |
| cloc for code metrics (`brew install cloc`) | Required |
| Python 3.10+ with `requests` | Required |

## Key Concepts

### Static Security Analysis

```bash
# Run semgrep security rules against vendor code
semgrep --config "p/security-audit" --config "p/owasp-top-ten" --json vendor/

# Python-specific security scan
bandit -r vendor/python-sdk/ -f json -o bandit-report.json

# JavaScript security scan
npx eslint --config .eslintrc-security.json vendor/js-sdk/ --format json

# Count lines of code for audit scope
cloc vendor/ --json | jq '{total: .SUM.code, languages: [to_entries[] | select(.key != "header" and .key != "SUM") | {lang: .key, code: .value.code}]}'
```

### Dangerous API Usage Detection

```bash
# Find network calls in third-party code
grep -rn 'fetch\|XMLHttpRequest\|axios\|requests\.get\|urllib' vendor/

# Detect file system access
grep -rn 'fs\.\|open(\|os\.path\|shutil\|pathlib' vendor/

# Find cryptographic operations
grep -rn 'crypto\|hashlib\|hmac\|cipher\|encrypt\|decrypt' vendor/

# Detect dynamic code execution
grep -rn 'eval\|exec\|Function(\|__import__\|importlib' vendor/
```

### Build Process Verification

```bash
# Check for install scripts (npm)
jq '.scripts | to_entries[] | select(.key | test("install|preinstall|postinstall"))' vendor/package.json

# Check for setup.py install hooks
grep -n 'cmdclass\|install\|develop' vendor/setup.py

# Verify no binary blobs
find vendor/ -type f -exec file {} \; | grep -i 'executable\|shared object\|binary'
```

## Workflow

### Step 1: Run automated security scans on third-party code

```bash
node scripts/agent.js --action scan --target /tmp/target --output /tmp/scan-result.json
```

### Step 2: Perform deep audit of specific package

```bash
node scripts/agent.js --action audit --target /tmp/target --output /tmp/audit-result.json
```

### Step 3: Generate third-party code audit report

```bash
node scripts/agent.js --action report --target /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Third Party Code Audit Detection
id: d923484d-f142-4707-9e2d-2167af518c90
status: experimental
description: Detects suspicious activity related to performing third party code audit techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*performing*third*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Third Party Code Audit Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] No critical or high severity vulnerabilities in static analysis
- [ ] No suspicious install scripts or build hooks
- [ ] No binary blobs or obfuscated code
- [ ] Network calls documented and justified
- [ ] Cryptographic operations use standard libraries correctly

## References

- [Semgrep Documentation](https://semgrep.dev/docs/)
- [Bandit Documentation](https://bandit.readthedocs.io/)
- [OWASP Code Review Guide](https://owasp.org/www-project-code-review-guide/)
- [CWE Top 25](https://cwe.mitre.org/top25/archive/2024/2024_cwe_top25.html)
