Where the Code Comes From

An application is built from far more code than its own team writes. That code is fetched from outside when the app is built, installed or loaded, and it enters the stack from the side.

Why It Matters

Most of an app's code comes from outside the team, and these points explain what that means for a defender. The sections below list every source of outside code, grouped by how it reaches the app, each with its own page.

Most of an app is packages, bundles of code written by strangers and fetched from a public registry such as npm or PyPI when the app is built. Often hundreds of them arrive through other packages, as transitive dependencies that nobody chose directly.
A package runs with the rights of whatever installs or runs it. On a laptop it gets the developer's access, on the build server its secrets and signing keys, and in the live app its data and credentials.
So one bad package reaches everything the app can reach, and every customer who installs the app or its next update.
Defenders keep a lockfile, which pins the exact version of every package a build installs, and an SBOM (software bill of materials), which lists every component a product contains. They run the ecosystem's audit tool and watch the OSV and GitHub advisory databases for known bad versions. They install through a private mirror or proxy, and they check signed provenance, a record of where and how a package was built, where the ecosystem offers it.