Dependency Scanning: articles and guides

The npm ecosystem is a top target for supply-chain attacks. How to scan npm packages for security risk — known vulnerabilities, malicious packages, and provenance — and build it into your workflow.