Package managers and repositories

Package managers tend to be a combination of two pieces: package management software on the developer’s machine and a package repository maintained (often for free use) by a third party.

Packages range from something as simple as the six-line leftpad to something as complex as a suite of Ethereum blockchain security testing tools coming in at 5.96 GB.3 Top package repositories often have their own clients that are included in the standard installations of the languages they support. For example, Node.js installs npm, and Python installs pip, which draws from the python package index, (PyPI).

3 https://socket.dev/blog/2023-npm-retrospective

Because the security of your source code is directly impacted by the integrity and safety of the packages you incorporate, knowing which package managers and repositories are used in your SDLC, and how they can be vulnerable, is fundamental to securing your source code.

The diversity of...