Why dependency security is critical in 2026?
In 2026, the supply chain is the #1 attack vector for frontend. According to Sonatype 2025-2026, attacks on open source registries grew 81% year-over-year, and 96% of JavaScript projects include vulnerable transitive dependencies. A single npm install can pull 800+ packages you never reviewed.
Recent cases: xz-utils backdoor, event-stream hijack and hundreds of typosquats on npm stealing env variables and CI tokens. In 2026, Google, GitHub and npm require signed provenance via Sigstore for critical packages.
js
# Basic audit every project must pass in CI in 2026
npm audit --audit-level=moderate
npm audit signatures # verifies Sigstore-signed provenance (npm 10+)
# If you use pnpm or bun (recommended in 2026)
pnpm audit --prod
bun audit
1. SBOM: your mandatory ingredients list
SBOM (Software Bill of Materials) is the complete list of every component, version, license and hash in your app. Like a nutrition label for software. In 2026 it is mandatory to sell to enterprises and US/EU government (Executive Order 14028, Cyber Resilience Act).
Standard format: CycloneDX or SPDX. Recommended tool: cyclonedx-npm generates your SBOM as JSON ready for audit and upload to Dependency-Track.
js
# Generate your SBOM in 2026 (CycloneDX)
npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON
# Verify generated SBOM
cat sbom.json | jq '.components | length'
# In a typical Next.js app: 1200-1800 components (including transitives)
js
// sbom.json (CycloneDX 1.6 excerpt)
{
"bomFormat": "CycloneDX",
"specVersion": "1.6",
"components": [
{
"name": "next",
"version": "16.3.3",
"type": "library",
"hashes": [{ "alg": "SHA-256", "content": "a1b2c3..." }],
"licenses": [{ "license": { "id": "MIT" } }],
"supplier": { "name": "Vercel" }
}
]
}
What to do with your SBOM:
- Upload to GitHub Dependency Graph (auto-generated with
npm audit signatures) - Store as CI artifact on every release
- Share with enterprise clients requiring compliance
- Detect incompatible licenses (GPL in MIT project, etc.)
2. npm audit signatures & Sigstore: no more blind npm install
Since npm 10, every package can be Sigstore-signed. npm audit signatures verifies the code you installed is exactly what the author published, with no tampering in the chain.
In 2026, 34% of top npm packages are signed (vs 8% in 2024). GitHub shows a green provenance badge on every verified release.
js
// .npmrc — enforce provenance in 2026 for critical projects
audit-level=moderate
provenance=true
// package.json — force signed versions when available
{
"overrides": {
"next": "16.3.3",
"react": "19.2.8"
},
"engines": {
"node": "22.x",
"npm": ">=10.8"
}
}
js
# .github/workflows/security.yml — CI that blocks PRs with vulns
name: Supply Chain Security
on: [push, pull_request]
jobs:
audit:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with: { node-version: '22' }
- run: npm ci --ignore-scripts
- run: npm audit signatures
- run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json
- uses: actions/upload-artifact@v4
with: { name: sbom, path: sbom.json }
- run: npm audit --audit-level=high
3. Automate protection: Renovate, Dependabot & lockfile
Dependabot and Renovate are mandatory in 2026. Do not update manually: let the bot open weekly grouped PRs, with tests and auto audit. Enforce strict lockfile (package-lock.json, pnpm-lock.yaml, bun.lockb) and never run npm install without npm ci in CI.
Recommended strategy for frontend in 2026:
- Grouped Renovate: 1 weekly PR for
devDependencies, 1 fordependencies, withautomergeif tests pass - Version pinning: use
exact("next": "16.3.3"without^) in critical projects - Script allowlist:
npm config set ignore-scripts trueand allowlist of permittedpostinstall(prevents cryptominers)
js
// renovate.json — 2026 recommended config
{
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
"extends": ["config:recommended"],
"packageRules": [
{
"groupName": "non-critical deps",
"matchUpdateTypes": ["minor", "patch"],
"automerge": true,
"schedule": ["every weekend"]
}
],
"lockFileMaintenance": { "enabled": true, "schedule": ["before 4am on monday"] },
"vulnerabilityAlerts": { "enabled": true }
}
js
# Security checklist before every deploy in 2026
npm ci --ignore-scripts
npm audit signatures
npm ls --depth=0
npx license-checker --summary
npx knip
4. Reduce attack surface: fewer deps, more control
The best dependency is the one you do not install. In 2026, tools like knip, depcheck and unimport detect dead code. Audit every new dependency: does author have 2FA? Sigstore signatures? Active maintenance? Own SBOM?
Signals of a trustworthy dependency in 2026:
- Verified provenance badge on npm/GitHub
- Mandatory 2FA for publishers, signed releases
- Published SBOM and clear changelog
- >1M weekly downloads and <30 days since last maintenance
