secondsky/sap-skills/sap-dependency-security

SAP Dependency Security

Related Skills

• sap-hana-cli: For dependency-aware database tooling workflows and upgrade guidance
• sap-cap-capire: For CAP dependency-safe runtime and service configuration guidance
• sap-fiori-tools: For secure UI5/Fiori dependency strategy when tooling touches frontend packages
• sapui5: For SAPUI5/OpenUI5 frontend dependency and MCP tooling review
• sap-datasphere: For tenant-connected Datasphere MCP and CLI dependency review
• sap-sac-scripting: For source-pinned SAC MCP setup and local install records

Manage SAP dependency security and upgrades with supply chain protection, compatibility analysis, staged rollout, and comprehensive testing across all major package managers.

When to Use This Skill

• Upgrading major framework or library versions
• Configuring supply chain attack prevention (cooldown, script blocking, lockfile hardening)
• Setting up secure package manager configuration
• Resolving dependency conflicts or peer dependency issues
• Planning incremental upgrade paths with testing
• Automating dependency updates with Renovate, Dependabot, or Snyk
• Auditing dependencies for vulnerabilities
• Setting up CI/CD dependency security workflows
• Pinning or reviewing SAP MCP servers in .mcp.json
• Reviewing SAP CAP, UI5/Fiori, HANA, Datasphere, SAC, SAP Cloud SDK, BTP/CF/mbt, or ABAP/gCTS dependency workflows

Common Issues

Two Modes of Operation

Interactive — Walk through setup questions to generate tailored config. Use for fresh setup.

Default — Apply recommended defaults immediately: 7-day cooldown, block all scripts, frozen-lockfile, lockfile-lint, Dependabot with cooldown. Customization optional.

SAP Development Mode — Use a stricter SAP posture: 14-day cooldown, exact pins for MCP servers and executable tooling, no floating @latest, source commit pins for local MCP servers, and manual review for tenant-connected tools.

SAP Development Mode

Use SAP Development Mode when dependency work touches SAP projects, SAP BTP deployment tooling, SAP SDKs, or any MCP server shipped by this repository.

Core rules:

1. Default to 14-day cooldown for SAP enterprise projects. Record explicit exceptions in the SAP MCP inventory or project review notes.
2. Treat MCP servers as executable dependencies. In .mcp.json, use exact npm pins such as @ui5/mcp-server@0.2.11, never @latest or bare package names.
3. Pin local-source MCPs by commit. SAC uses the trusted secondsky/sap_analytics_cloud_mcp fork and must record commit 2020235505d98111c2889598ab2217c1619b6943.
4. Keep runtime authorization separate. This skill covers package/source/executable trust; use the relevant SAP skill for tenant role design and business authorization.
5. Validate MCP drift with npm run validate:mcp-security after any .mcp.json or SAP MCP inventory change.

Load references/sap-dependency-risk-matrix.md for SAP stack coverage and references/sap-mcp-security.md for MCP update workflow and SAC source-install policy. Use references/sap-mcp-inventory.json as the machine-readable approved MCP package/source list.

Interactive Setup Flow

When the user wants tailored configuration, walk through these decisions. Skip this section entirely if using default mode.

Tier 1: Required Decisions

Always ask these 3 questions before generating any config:

1. Package Manager

"Which package manager does this project use?"

2. Cooldown Period

"How many days should newly published packages age before install? This prevents supply chain attacks where malicious packages are discovered and unpublished within days."

3. Post-Install Script Policy

"How should lifecycle scripts (postinstall, preinstall) be handled? These are the #1 attack vector for supply chain attacks."

Tier 2: Security Tooling (Offer as Batch)

"Which of these security features would you like to configure? Select any that apply."

4. CI/CD Automation Tool

5. Automerge Policy

6. Update Schedule

7. Install-Time Security Tooling

"Which security tools should protect dependency installation?"

Load references/socket-cli-guide.md for full Socket CLI setup including authentication and free vs authenticated features.

8. Lockfile Validation

Tier 3: Advanced Options (Only If User Opts In)

"Would you like to configure any advanced options?"

9. Dev Containers — Generate hardened .devcontainer/devcontainer.json (Yes/No)

10. Secrets Manager — 1Password CLI / Infisical / None

11. pnpm Trust Policy — Enable trustPolicy: no-downgrade (pnpm 10.21+ only, Yes/No)

12. Cooldown Exclusions — Package names that bypass cooldown (e.g., @types/react, typescript, esbuild)

Security-First Upgrade Principles

1. Cooldown before installing — Wait 7 days for general projects or 14 days for SAP enterprise/MCP workflows so new package versions are vetted by the community
2. Block post-install scripts — Prevent arbitrary code execution during npm install
3. Freeze lockfiles in CI — Use deterministic installs (npm ci, --frozen-lockfile)
4. Validate lockfile integrity — Use lockfile-lint to detect injection
5. Audit before trusting — Use npq or Socket CLI to check packages before installing
6. Upgrade incrementally — One major version at a time with testing between each
7. Never blindly upgrade — Avoid npm update or npm-check-updates -u without review
8. Scan before and after — Use socket scan to detect supply chain issues beyond CVEs
9. Pin SAP MCP executables — Use exact npm versions or source commit pins before letting MCP servers access SAP projects or tenants

Cooldown Period: Prevent Supply Chain Attacks

Newly published packages may contain malicious code discovered within hours. Configure a cooldown period to delay installation.

Quick Setup

npm (.npmrc):

min-release-age=7

Bun (bunfig.toml):

[install]
minimumReleaseAge = 604800  # 7 days in seconds
minimumReleaseAgeExcludes = ["@types/bun", "typescript"]

pnpm (pnpm-workspace.yaml):

minimumReleaseAge: 10080  # 7 days in minutes
minimumReleaseAgeExclude:
  - '@types/react'
  - typescript

Yarn (.yarnrc.yml):

npmMinimalAgeGate: "7d"
npmPreapprovedPackages:
  - "@types/react"
  - "typescript"

Load references/cooldown-config-guide.md for detailed per-PM configuration, CI tool integration, and exclusion patterns.

Use templates/<pm>-security.tmpl for copy-paste ready config files.

Disable Post-Install Scripts

Post-install scripts are the most common supply chain attack vector (Shai-Hulud, Nx, event-stream incidents).

Quick Setup

npm:

npm config set ignore-scripts true
npm config set allow-git none

Bun: Disabled by default. Allow specific packages in package.json:

{ "trustedDependencies": ["esbuild", "sharp"] }

pnpm (10.0+): Disabled by default. Allow specific packages in pnpm-workspace.yaml:

allowBuilds:
  esbuild: true
strictDepBuilds: true  # Hard error on unreviewed scripts

Load references/package-manager-security.md for full per-PM hardening including pnpm trustPolicy, blockExoticSubdeps, and @lavamoat/allow-scripts.

Deterministic & Frozen Installs

Always use frozen install commands in CI to ensure reproducible builds:

Commit all lockfiles to version control: package-lock.json, bun.lock, pnpm-lock.yaml, yarn.lock, deno.lock.

Lockfile Validation

Install and configure lockfile-lint to detect lockfile injection attacks:

npm install --save-dev lockfile-lint

{
  "scripts": {
    "lint:lockfile": "lockfile-lint --path package-lock.json --type npm --allowed-hosts npm --validate-https",
    "preinstall": "npm run lint:lockfile"
  }
}

Note: lockfile-lint does not currently support Bun's bun.lock / bun.lockb formats.

Pre-Install Security Auditing

npq — Pre-Install Auditor

npm install -g npq
npq install <package>          # Audit before installing
npq install <package> --dry-run # Audit without installing
 
# Shell alias for seamless use
alias npm='npq-hero'
 
# Use with other PMs
NPQ_PKG_MGR=pnpm npq install <package>
NPQ_PKG_MGR=bun npq install <package>

Socket Firewall (sfw) — Real-Time Blocker

npm install -g sfw
sfw npm install <package>      # Blocks malicious packages
sfw pnpm add <package>
sfw yarn add <package>

Load references/supply-chain-security.md for full comparison of npq vs sfw and what each validates.

Socket CLI Integration

Socket CLI provides proactive supply chain security beyond basic vulnerability scanning — covering malware detection, typosquatting, protestware, install script risks, and license compliance.

Proactive Upgrade Workflow