What you didn’t import still ships with you

Twelve names in the manifest, far more in the lockfile

ShopCart’s package manifest lists 12 direct dependencies. The lockfile lists 187 packages. Maya did not type most of those names. A direct dependency is one the application declares. A transitive dependency is one a dependency pulls in, and then one that dependency pulls in. OWASP Top 10:2025 A03:2025 Software Supply Chain Failures describes failures in building, distributing, or updating software, including nested dependencies, not only the packages a developer remembers.

The tree below is fiction, labeled as such. shopcart-api declares receipt-mail. receipt-mail declares leftpad-lite, a made-up package. leftpad-lite declares tiny-json, also made-up. Nobody on the facilities ticket asked for leftpad-lite. It still ships if the lockfile does. A scanner finding on that leaf is a lead. It is not, by itself, proof that ShopCart must stop tonight.

Unmaintained is a condition, not a headline exploit

A03 maps several weakness themes, including use of unmaintained third-party components (CWE-1104), reliance on a component that is not updateable (CWE-1329), and dependency on a vulnerable third-party component (CWE-1395). Teach the condition. Do not invent a CVE, a maintainer’s resignation date, or an exploit for leftpad-lite. You are in the vulnerable column of A03 when you do not track versions, including nested ones, when software is unsupported or out of date, or when you cannot see changes across the chain.

Prevention on that page is operational: keep a continuous inventory of client and server components and their nested dependencies, obtain components from official sources over secure links, and prefer signed packages. A successful install is not a trust decision. A pin records which version you meant to build. It does not freeze the vulnerability. When a component is unused, remove it. When it is unmaintained and you still need the job, plan a migration. Ignoring it is not a plan.

• Direct: declared by ShopCart. Transitive: arrived through another package.
• Inventory: lockfile, a generated SBOM, and composition analysis.
• Unmaintained: no security fixes you can take. Plan a move, or a documented exception.
• A scanner row is evidence to triage, not an automatic outage.

Build tools are still in the chain

The lockfile also contains a test runner used only while CI builds ShopCart. It is not imported by the receipt worker at runtime. That does not make it harmless. A03’s prevention list calls out developer tooling and CI as places that need updates, and the next lesson is about who can promote what that tooling builds. A dev-only package that runs in the pipeline can still change the artifact everyone later calls trusted.

Maya’s note for the facilities review: open the lockfile, circle one transitive name she did not choose, and write one response. For leftpad-lite she writes “unused path through receipt-mail; confirm whether receipt-mail can drop it; if not, schedule a replacement before the next merch season.” She does not paste a proprietary tree from another employer into the ticket, and she does not claim a real CVE.