Reducing supply chain risk

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which approach best reduces supply chain risk when building an app?

A Add every package that might save you time

B Use fewer, well-known dependencies

2. Which line pins a version number?

A requests

B requests==2.31.0

3. Why do developers pin a dependency to one exact version?

A So a surprise or tampered update is not installed automatically

B So the package can never have any vulnerabilities

4. You find a package you want to use. What should you do BEFORE adding it?

A Review it: check who made it, how popular it is and when it was last updated

B Install it straight away and check later if something breaks

5. What does an automated vulnerability scanner do?

A Checks your dependencies against lists of known vulnerabilities

B Finds brand new flaws that nobody has discovered yet

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1requests==2.31.0		APins the dependency to one exact version so a surprise new release cannot slip into your project
2npm audit		Bflask==3.0.0
3Pin a dependency to an exact, reviewed version so it does not change without you knowing		Cpip install --require-hashes -r requirements.txt
4Check a dependency's downloaded file matches a trusted fingerprint to verify its integrity		DThe package was added without reviewing it. The odd name could be a fake lookalike of a trusted package. Check the name, author and popularity first, then install the trusted one.
5requests>=2.0		EAutomatically scans your dependencies for known vulnerabilities and reports them
6pip install fast-requestz		FThe >= sign allows any newer version, so an unreviewed or compromised release could be installed. Pin it with == to one exact version, like requests==2.31.0.

Definitions

reduce supply chain risk

Fill in the Blanks

Complete each line of code by filling in the missing parts.

requests__2.31.0 flask==3.0.0

npm _____

npm __

IF trusted ___ needed THEN add(package) ENDIF

_________ -r requirements.txt

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A requests==2.31.0

B flask==3.0.2

C numpy>=1.0

Question 2

A dep ← 'fastdate'

B age ← countDownloads(dep)

C IF age < 12 THEN

D review(dep)

E ELSE reject(dep)

Question 3

A pip install pip-audit

B pip install -r reqs.txt

C echo Scan finished

Question 4

A FOR each dep IN dependencies

B used ← isImported(dep)

C IF NOT used THEN

D add(dep)

E END FOR

Question 5

A file ← download(package)

B hash ← length(file)

C IF hash = publishedHash THEN

D install(file)

Answer Key

Reducing supply chain risk

Section A: Quick Questions

B — Use fewer, well-known dependencies

B — requests==2.31.0

A — So a surprise or tampered update is not installed automatically

A — Review it: check who made it, how popular it is and when it was last updated

A — Checks your dependencies against lists of known vulnerabilities

Section B: Match the Pairs

requests==2.31.0 → Pins the dependency to one exact version so a surprise new release cannot slip into your project

npm audit → Automatically scans your dependencies for known vulnerabilities and reports them

Pin a dependency to an exact, reviewed version so it does not change without you knowing → flask==3.0.0

Check a dependency's downloaded file matches a trusted fingerprint to verify its integrity → pip install --require-hashes -r requirements.txt

requests>=2.0 → The >= sign allows any newer version, so an unreviewed or compromised release could be installed. Pin it with == to one exact version, like requests==2.31.0.

pip install fast-requestz → The package was added without reviewing it. The odd name could be a fake lookalike of a trusted package. Check the name, author and popularity first, then install the trusted one.

Section C: Definitions

reduce supply chain risk — Use fewer, trusted dependencies, pin versions, verify integrity and scan for known vulnerabilities so a weak link in code you rely on cannot harm your system.

Section D: Fill in the Blanks

requests==2.31.0
flask==3.0.0

npm audit

npm ci

IF trusted AND needed THEN
add(package)
ENDIF

pip-audit -r requirements.txt

Section E: Spot the Error

C — The version is not pinned. '>=1.0' lets any newer version install, including a compromised one. It should be a fixed version such as numpy==1.26.4.

B — The check compares age to 12 months, but this line counts downloads instead. It should be age ← monthsSinceUpdate(dep) so abandoned packages are rejected.

B — This line installs the packages and does not scan them. Automated vulnerability scanning needs pip-audit -r reqs.txt.

D — Unused dependencies should be removed to reduce risk. Adding them increases the attack surface. The line should be remove(dep).

B — File length cannot prove integrity because a tampered file can be the same size. The line should compute a hash: hash ← sha256(file).