Dependency Manifests
Overview
Section titled “Overview”Evidence: Dependency Manifests
Description: Collect developer dependency manifests
Category: Applications
Platform: windows
Short Name: depman
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”Developer dependency manifests and lockfiles define declared and resolved third-party packages used by software projects. Covered formats include package.json, package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock, go.mod, requirements.txt, Pipfile.lock, pyproject.toml, poetry.lock, Cargo.toml, pom.xml, composer.json, Gemfile, Gemfile.lock, Gradle files, and NuGet project files. These files are primary targets for supply chain attacks including dependency confusion, typosquatting, and known-malicious package injection.
Data Collected
Section titled “Data Collected”This collector gathers structured data about declared and resolved dependencies, including package names, version constraints, resolved versions, source registries, integrity hashes, direct or transitive status, and whether a lock file is present. Results are recorded in dependency_manifests.
Collection Method
Section titled “Collection Method”This collector scans user home directories and common development paths for dependency manifest and lock files. Each file is parsed to extract package metadata. Directories such as node_modules, vendor, and .git are skipped for performance.
Forensic Value
Section titled “Forensic Value”Dependency manifest data is critical for detecting supply chain compromises. Investigators can identify known-malicious packages, typosquatted dependencies, dependency confusion attacks, and missing lock files that indicate insecure dependency resolution.