Software Composition Analysis

Software Composition Analysis (SCA) goes beyond vulnerability scanning to cover legal compliance and comprehensive dependency visibility.

License compliance risks:

• GPL/AGPL: Using GPL code in a commercial product may require open-sourcing your own code
• LGPL: Dynamic linking is generally OK but requires providing the LGPL library in modifiable form
• Copyleft propagation: Transitive GPL dependencies can affect your license obligations

Example license chain issue:

npm ls --all | grep license-check
# Your app uses: lodash (MIT) — OK!
# But a dependency uses: some-lib (GPL-3.0) — Risk!

license-checker --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause'
# Exit code 1 if any dependency has a disallowed license

Unpatched transitive dependencies:

You might update all direct dependencies to patched versions but still have transitive dependencies using vulnerable packages. Without an SBOM, you lack visibility into the full dependency tree.

Implement SCA practices with automated tooling integrated into CI/CD pipelines.

Generate a Software Bill of Materials (SBOM):

# CycloneDX SBOM for Node.js projects
npm install -g @cyclonedx/cyclonedx-npm
cyclonedx-npm --output-format JSON --output-file sbom.json

# Syft for container images
syft myapp:latest -o cyclonedx-json=sbom.json

# SBOM documents: every package, version, license, and hash
# Enables: vulnerability scanning, license audit, supply chain attestation

License compliance in CI:

- name: Check dependency licenses
  run: |
    npx license-checker \
      --production \
      --onlyAllow "MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC" \
      --excludePackages "internal-package"
  # Fails if any dependency has a disallowed license

Defense checklist:

• Generate an SBOM for every release (CycloneDX or SPDX format)
• Run license compliance checks in CI
• Define and document your allowed license policy
• Scan the full transitive dependency tree, not just direct dependencies
• Store SBOMs alongside release artifacts for audit purposes