Snyk Open Source | TryHackMe Writeup

Introduction

Let’s start by meeting Jessica!

No Answer Needed

---

Meet Jessica

Ready? Let’s get going!

No answer needed

---

Understanding Open Source Security Risks

Which JSON-formatted manifest file serves as the central hub for Node.js projects, listing metadata, scripts, and dependency declarations?

package.json

How many dependencies do we have for this new feature?

5

Which term describes indirect package dependencies formed through shared prerequisites, possibly concealing vulnerabilities and demanding cautious assessment?

Transitive dependencies

---

Getting Started with Snyk Open Source

What single authentication mechanism allows users to transition smoothly amongst various linked platforms and services?

Single sign-on

---

Diving Deeper Into Vulnerabilities

What is the version of the vulnerable lodash package?

2.4.2

Which vulnerability allows an attacker to modify an Object?

Prototype Pollution

---

Remediating Vulnerabilities

What does CVSS stand for?

Common Vulnerability Scoring System

Should the development team bulk fix all the vulnerabilities found in this new feature? (y/n)

N

---

Automating the Process Through CI/CD Pipelines

How does CircleCI help streamline pipeline configuration and standardisation?

Orb

What file defines the GitHub Actions workflow configuration that enables automation and customised sequences for building, testing, and deploying?

YAML

---

Implementing Continuous Monitoring

Which collaborative DevOps practice combines real-time communication channels, automation, and operational agility?

ChatOps

---

Establishing Best Practices

Well done Jessica, she did it!

No answer needed

---

Hope this walkthrough helped!