← Years 9–10 Digital Systems

Reducing supply chain risk

Use fewer, trusted dependencies, pin versions, verify integrity and scan for known vulnerabilities so a weak link in code you rely on cannot harm your system.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 70, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 70

Understanding Reducing supply chain risk in Years 9–10 Digital Systems

What it does: Writing the exact version with == pins the dependency, so only the version you reviewed gets installed. The --require-hashes option makes pip verify each package against a known hash, so a tampered file is rejected. Every dependency is another link in your supply chain. Fewer, trusted ones mean fewer weak links an attacker can use. Pinning gives you control over when a change enters your project. You still need to scan and update on purpose, because old versions can have known flaws. Reviewing a dependency first helps you spot abandoned, suspicious or fake packages before they get into your system.

Common mistakes: The version is not pinned. '>=1.0' lets any newer version install, including a compromised one. It should be a fixed version such as numpy==1.26.4. The check compares age to 12 months, but this line counts downloads instead. It should be age ← monthsSinceUpdate(dep) so abandoned packages are rejected.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Reducing supply chain risk to a class →

This module's key terms are also in a printable crossword (Modules 70–79) and word search (Modules 41–79).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which approach best reduces supply chain risk when building an app?

Add every package that might save you timeUse fewer, well-known dependencies

Matches

requests>=2.0

↓

The >= sign allows any newer version, so an unreviewed or compromised release could be installed. Pin it with == to one exact version, like requests==2.31.0.

Applying

Meanings

Term

reduce supply chain risk

Meaning

Use fewer, trusted dependencies, pin versions, verify integrity and scan for known vulnerabilities so a weak link in code you rely on cannot harm your system.

Practice

requests==2.31.0

Testing

Gaps

requests2.31.0

Check Answer

Spots

2flask==3.0.2

3numpy>=1.0

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which approach best reduces supply chain risk when building an app?

A. Add every package that might save you time

B. Use fewer, well-known dependencies ✓

Every dependency is another link in your supply chain. Fewer, trusted ones mean fewer weak links an attacker can use.

2. Which line pins a version number?

A. requests

B. requests==2.31.0 ✓

Writing the exact version (==2.31.0) pins it. Without a version, you might get a newer one that was tampered with or has a bug.

3. Why do developers pin a dependency to one exact version?

A. So a surprise or tampered update is not installed automatically ✓

B. So the package can never have any vulnerabilities

Pinning gives you control over when a change enters your project. You still need to scan and update on purpose, because old versions can have known flaws.

4. You find a package you want to use. What should you do BEFORE adding it?

A. Review it: check who made it, how popular it is and when it was last updated ✓

B. Install it straight away and check later if something breaks

Reviewing a dependency first helps you spot abandoned, suspicious or fake packages before they get into your system.

5. What does an automated vulnerability scanner do?

A. Checks your dependencies against lists of known vulnerabilities ✓

B. Finds brand new flaws that nobody has discovered yet

Scanners compare your dependencies with databases of known problems. They cannot find zero-day flaws that have not been reported.

Match the Pairs

requests==2.31.0 → Pins the dependency to one exact version so a surprise new release cannot slip into your project

npm audit → Automatically scans your dependencies for known vulnerabilities and reports them

Pin a dependency to an exact, reviewed version so it does not change without you knowing → flask==3.0.0

Check a dependency's downloaded file matches a trusted fingerprint to verify its integrity → pip install --require-hashes -r requirements.txt

requests>=2.0 → The >= sign allows any newer version, so an unreviewed or compromised release could be installed. Pin it with == to one exact version, like requests==2.31.0.

pip install fast-requestz → The package was added without reviewing it. The odd name could be a fake lookalike of a trusted package. Check the name, author and popularity first, then install the trusted one.

Key Term

reduce supply chain risk

Use fewer, trusted dependencies, pin versions, verify integrity and scan for known vulnerabilities so a weak link in code you rely on cannot harm your system.

Fill in the Blanks

1. requests==2.31.0 flask==3.0.0

Hint: Type the operator that pins a dependency to one exact version.

2. npm audit

Hint: Type the npm subcommand that checks installed packages for known vulnerabilities.

3. npm ci

Hint: Type the npm command that installs the exact versions recorded in the lock file.

4. IF trusted AND needed THEN add(package) ENDIF

Hint: Type the logical operator that requires both review checks to be true before adding.

5. pip-audit -r requirements.txt

Hint: Type the tool name that scans a Python requirements file for known vulnerabilities.

Spot the Error

Question 1

A requests==2.31.0

B flask==3.0.2

C numpy>=1.0

Line C — The version is not pinned. '>=1.0' lets any newer version install, including a compromised one. It should be a fixed version such as numpy==1.26.4.

Question 2

A dep ← 'fastdate'

B age ← countDownloads(dep)

C IF age < 12 THEN

D review(dep)

E ELSE reject(dep)

Line B — The check compares age to 12 months, but this line counts downloads instead. It should be age ← monthsSinceUpdate(dep) so abandoned packages are rejected.

Question 3

A pip install pip-audit

B pip install -r reqs.txt

C echo Scan finished

Line B — This line installs the packages and does not scan them. Automated vulnerability scanning needs pip-audit -r reqs.txt.

Question 4

A FOR each dep IN dependencies

B used ← isImported(dep)

C IF NOT used THEN

D add(dep)

E END FOR

Line D — Unused dependencies should be removed to reduce risk. Adding them increases the attack surface. The line should be remove(dep).

Question 5

A file ← download(package)

B hash ← length(file)

C IF hash = publishedHash THEN

D install(file)

Line B — File length cannot prove integrity because a tampered file can be the same size. The line should compute a hash: hash ← sha256(file).

Student with a class code? Join your class →