Modern applications are mostly other people's code. That fact used to be a joke at conferences. After repeated package abuse campaigns and compromised maintainer accounts, it reads like a risk statement. Boards already understand vendor risk. Dependency risk is vendor risk with a faster update cycle and fewer contracts. Open source supply-chain risk covers malicious packages, typosquatting, compromised build pipelines, and abandoned libraries with known holes. Ignoring it is no longer a quirky engineering preference. It is a governance failure that shows up in customer questionnaires long before it shows up in headlines.
Inventory before ideology
You cannot protect what you cannot list. Generate SBOMs for released artifacts. Track direct and transitive dependencies. A payments company in Bangalore discovered a critical transitive library only after a scanner ran in CI for the first time. The library had been there for years. Attention had not. Discovery without ownership is just a longer spreadsheet.
Controls that reduce drama
Pin versions. Prefer lockfiles. Mirror critical packages internally when warranted. Require signed commits and protected branches for release pipelines. Review new dependencies like you review new vendors: who maintains this, how active is it, what permissions does the install script want? A surprising postinstall script is a reason to stop, not a reason to shrug.
Caution: blocking every finding without triage creates alert fatigue and shadow installs via USB sticks and personal npm tokens. Severity, exploitability, and exposure should guide response times. Not every CVE is an equal emergency. Treat criticals on internet-facing services differently from theoretical issues in an internal tool nobody runs.
A workable baseline
- SBOM generation on release.
- Automated vulnerability scanning with owners for criticals.
- Allowlist for package registries where possible.
- Incident playbook for "yank the bad version" and rebuild.
- Include container registries and build caches in the playbook, not only Git tags.
One team tabletopped a malicious postinstall script scenario. They found their rollback docs assumed Git tags were enough and forgot container registries. The drill was embarrassing. The real incident would have been worse. Embarrassment in a drill is cheap. Embarrassment in production is not.
Governance language and maintainer reality
Translate scanner output into governance language. Critical vulnerabilities on internet-facing services get a clock. Internal tools get a queue. Abandoned libraries on the hot path get a replacement plan. When leadership sees dependencies the way they see vendors, funding for maintenance stops being a surprise ask after a near miss.
Open source maintainers are part of your supply chain whether you pay them or not. Budget time to upgrade, contribute fixes, or pay for support where the risk justifies it. Pretending the commons is an infinite free warehouse is how emergencies get scheduled for you. A modest patronage or support contract on a critical library is often cheaper than an emergency rewrite under disclosure pressure. Across APAC markets, the constraint is rarely a lack of tools. It is a lack of sequenced decisions that survive contact with procurement, language reality, and peak-season load. Sequence the decisions. Publish the owners. Revisit the sequence when the metrics stall instead of buying another overlapping category. A useful internal test is whether a skeptical finance partner can understand the unit economics without a translator from engineering slang. If the story only works in a specialist room, it is not ready for production funding. Translate early. Funding follows comprehension more often than it follows novelty. None of this removes the need for craft. It simply refuses to confuse craft with theater. Craft shows up in the details customers and operators feel. Theater shows up in diagrams that never change a Monday morning workflow. Keep the craft. Cut the theater. Repeat until the program is dull in the best sense.
Takeaway
Manage open source like a supply chain: inventory, verify, monitor, respond. Boards already understand vendor risk. Help them understand dependency risk in the same language, with owners and timelines, not only with scanner screenshots.