> ## Content Index > Fetch the complete content index at: https://securinglaravel.com/llms.txt > Use this file to discover other available public pages before exploring further. # Security Tip: Replace Simple Dependencies - URL: https://securinglaravel.com/security-tip-replace-simple-dependencies/ - Published: 2023-05-09T18:00:58.000Z - Updated: 2025-01-28T02:19:24.000Z - Description: [Tip#45] The more dependencies your project has, the higher your risk of supply-chain attack is, and the less you're aware of what code is actually running... - Author: Securing Laravel - Tags: Security Tips, Audits Top 10, Composer, Dependencies ℹ️ **This is part of my series on the* [**Top 10 Security Issues*](https://securinglaravel.com/tag/audits-top-10/) *discovered during my Laravel Security Audits, as of April 2023\.* **#1 →* [**Exposed API Keys & Passwords*](https://securinglaravel.com/in-depth-storing-environment-variables/) **#2 →* [**Missing Authorisation*](https://securinglaravel.com/security-tip-test-for-missing-authorisation/) **#3 →* [**Missing Content Security Policy (CSP)*](https://securinglaravel.com/security-tip-getting-started-with-csp/) **#4 →* [**Missing Security Headers*](https://securinglaravel.com/security-tip-security-headers-are/) **#5 →* [**Insecure Function Use*](https://securinglaravel.com/in-depth-what-are-insecure-functions/) ***#6 → Outdated & Vulnerable Dependencies** **#7 →* [**Cross-Site Scripting (XSS)*](https://securinglaravel.com/security-tip-avoiding-xss-with-htmlstring/) **#8 →* [**Insufficient Rate Limiting*](https://securinglaravel.com/security-tip-dont-forget-rate-limiting/) **#9 →* [**Missing Subresource Integrity (SRI)*](https://securinglaravel.com/security-tip-subresource-integrity/) **#10 →* [**Insufficient Input Validation*](https://securinglaravel.com/security-tip-validating-array-inputs/) *&* [**Mass-Assignment Vulnerabilities*](https://securinglaravel.com/in-depth-mass-assignment-vulnerabilities/) Given the huge dependence on frameworks and shared components, supply-chain attacks are a real risk to modern web applications. Laravel alone pulls in a significant number of packages by default, and then we add in our own packages for different features, they pull in even more… those numbers very quickly add up. Not to mention the sheer multitude of packages required in the JS world… 😱 It becomes harder and harder to keep track of all of the packages in your app, and then something like the recent [Packagist.org maintainer account takeover](https://blog.packagist.com/packagist-org-maintainer-account-takeover/?ref=securinglaravel.com) occurs, and you find yourself with a package that has been compromised and injected with some malicious code. 🙃 **To be fair, the person responsible for the recent account takeover was* [**just looking for a job*](https://www.bleepingcomputer.com/news/security/researcher-hijacks-popular-packagist-php-packages-to-get-a-job/?ref=securinglaravel.com)**, but* [**not everyone has such benign intentions*](https://www.bleepingcomputer.com/news/security/popular-python-and-php-libraries-hijacked-to-steal-aws-keys/?ref=securinglaravel.com)**...* A common “solution” you’ll hear from infosec folks is to “review all dependencies before using them”, but this is completely useless advice. No one has time to review every dependency they use! **Instead, I recommend you replace simple dependencies with your own in-house versions.** I’m talking about Laravel-specific wrappers around other packages (there are a multitude of these), or middleware helpers, blade components, JS helpers, etc. So many of these packages really only contain one or two actual classes, and then often pull in other dependencies. By replacing them with your own in-house code, you’re eliminating at least one dependency (and often a lot more) that could be compromised and injected with malware. Even things like vendor SDKs can be easily replaced - if the API is simple and/or you’re only using a subset of the endpoints, you may find that ripping out the vendor SDK and using [Laravel’s HTTP Client](https://laravel.com/docs/10.x/http-client?ref=securinglaravel.com) does everything you need, without the bloated and clunky vendor SDK. 💡 **This is especially true when the vendor isn’t a PHP shop, and their code is complete rubbish. I’ve done this a few times, and the features of Laravel’s HTTP Client won me over completely. It’s surprisingly powerful and makes working with APIs really easy!* So go take a look at your `composer.json` and `package.js` and see what you can remove. 🧐 ## More About Vulnerable & Outdated Dependencies - [Security Tip: Keep Dependencies Updated](https://securinglaravel.com/security-tip-keep-dependencies-updated) - [OWASP Top 10 → #6 - Vulnerable and Outdated Components](https://securinglaravel.com/owasp-tip-a062021-vulnerable-and) - [Security Tip: Composer Audit](https://securinglaravel.com/security-tip-composer-audit) --- ***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.* *When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* *You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*