--- description: "The Fluid Attacks platform allows you to track the security of software dependencies in your app, learn the reachability analysis results and download SBOMs." keywords: "Supply chain section, Fluid Attacks supply chain security, reachability analysis, reachable dependency vulnerabilities, Fluid Attacks SBOM, Fluid Attacks platform, Fluid Attacks documentation" other: private: false title: Analyze your supply chain security --- # Analyze your supply chain security import { Image } from "@/components/image"; > [!NOTE] > > **[Role](https://help.fluidattacks.com/portal/en/kb/articles/understand-roles) required:** User, Vulnerability Manager or Group Manager The **Packages** section within **Inventory** is designed to give you visibility into the dependencies used across all active repositories in a group, helping you monitor the status of these dependencies, regarding updates, security advisories and [reachable vulnerabilities](https://help.fluidattacks.com/portal/en/kb/articles/find-reachable-dependency-vulnerabilities). Know software dependencies list on the Fluid Attacks platform

Know software dependencies list on the Fluid Attacks platform

## Views of Packages ### Packages The **Packages** section shows you all the third-party dependencies used across the code repositories of your group. This is the information provided by the table: - **Dependency:** Name of the open-source component or dependency - **Repository:** The nickname your organization has given to the repository where the dependency is used - **Version status:** Indicates the version of the dependency currently in use by your project plus security-relevant status regarding the dependency version, where the following values are possible: - **Reachable:** A vulnerable element of the dependency is effectively called by your application, thus generating the risk of the vulnerability being exploited in the context of your application. - **Vulnerable:** Advisories have been issued for that dependency version. - **Outdated:** A newer version of the dependency is available, in which case the column shows the suggested upgrade. - **Updated:** The dependency is in its latest version. - **Malware:** Malicious software was detected in that dependency version. - **Vulnerabilities:** The number of detected vulnerabilities of each CVSS qualitative severity rating - **License:** The license of the software package, like ISC or MIT, which defines how your project can legally use its code - **Last publish:** Time since the latest version was released - **Locations:** The number of files within the repo that contain, or correspond to, the dependency > [!TIP] > > Click on the link to enter the Package Imports section. You can click on the columns button (

) to open a window where you can reorder, show or hide columns. Manage columns in packages on the Fluid Attacks platform

You can filter the dependencies by variables that are visible in the table as well as the following: the Docker images containing them, the package manager used, and the stage in which your project depends on the third-party dependencies. Filter the Supply chain section on Fluid Attacks platform

Filter the Supply chain section on Fluid Attacks platform

Filter dependencies Identify outdated dependencies on the Fluid Attacks platform

Apply filter by 'Version status' ## Package Imports In the **Packages** section, when you click on the links in the **Locations** column, you are taken to a table showing information of your files related to the selected third-party dependency. See direct dependency in production on the Fluid Attacks platform

See direct dependency in production on the Fluid Attacks platform

Use of the direct dependency in the production stage See transitive dependency in development and prod on the Fluid Attacks platform

Use of the transitive dependency in the development and production stages The table columns provide the following information: 1. **Transitivity:** Whether the listed vulnerable files in your software are directly or indirectly related to the third-party component in question: 1. **D:** Short for 'Direct'; the file in your project explicitly imports and uses the third-party dependency 1. **T:** Short for 'Transitive'; the third-party dependency is required by your direct dependencies, but not directly imported by the file in your project 1. **U:** Short for 'Undeterminable'; for this file, it is impossible to determine whether the dependency is direct or transitive 1. **Locations:** The file related to the third-party dependency 1. **Specific:** The exact line of code that shows the relation with the third-party dependency stated in **Transitivity** 1. **Stage:** The stage(s) in which your project depends on the third-party dependency: 1. **Build:** Your file depends on the third-party component only in the software development stage 1. **Run:** Your file depends on the third-party component in the live production environment 1. **Vulnerabilities associated:** The number of vulnerabilities related to the third-party dependency By clicking on the code branch icon next to the **T** in each of your transitive dependencies, you will find the **dependency path** that goes from the direct to the affected transitive dependency in question ("grunt-if" and "y18n," respectively, in the following example image): See dependency paths for transitive dependencies on the Fluid Attacks platform

See dependency paths for transitive dependencies on the Fluid Attacks platform

Example of a dependency path By clicking on the vulnerabilities associated link, you get a pop-up window with the vulnerability details: See dependency vulnerability on the Fluid Attacks platform

See dependency vulnerability on the Fluid Attacks platform

1. **Vulnerability:** The file path where the vulnerability is found 1. **Specific:** The exact line of code that shows the relation with the third-party dependency stated before in **Transitivity** 1. **Advisory ID:** The identifier for the vulnerability advisory or [Common Vulnerabilities and Exposures](https://cve.mitre.org/) (CVE) entry 1. **Affected version:** The dependency versions which are affected by the vulnerability 1. **Severity:** The qualitative severity rating according to the Common Vulnerability Scoring System ([CVSS](https://help.fluidattacks.com/portal/en/kb/articles/glossary#CVSS)) 1. **Reported:** The link to the reported vulnerability on the platform If you click on the downward-facing arrow, you can see a description taken from the advisory source and reference URLs. View dependency advisory description on the Fluid Attacks platform

View dependency advisory description on the Fluid Attacks platform

## Supported package managers Currently, supply chain analysis is supported for the following package managers: 1. Alpine Package Keeper (apk) 1. APK (Android Package) 1. Bundler (Ruby) 1. Cargo (Rust) 1. CocoaPods (Swift) 1. Composer (PHP) 1. Dart Pub (Dart) 1. dpkg (Debian) 1. Gradle (Java) 1. Hex (Elixir) 1. Maven (Java) 1. NPM (JavaScript) 1. NuGet (.NET) 1. Pacman (Arch Linux and derivatives) 1. PECL (PHP) 1. Pip (Python) 1. Pipenv (Python) 1. PNPM (JavaScript) 1. Poetry (Python) 1. RPM (Redhat) 1. Swift Package Manager (Swift) 1. YARN (JavaScript) ## Supported Docker images Currently, supply chain analysis is supported for the following Docker images: 1. Alpine Linux 1. Arch Linux 1. Distros based on Debian (Ubuntu, Debian) 1. Distros based on Red Hat or Fedora > [!TIP] > > Excited to start using the platform? Explore [Meet the platform](https://help.fluidattacks.com/portal/en/kb/find-security-vulnerabilities/use-the-platform/meet-the-platform) to learn where to start and where everything is. ## **Export SBOM** The inventory of open-source software in your project is available on the platform in two different formats: CycloneDX and SPDX. Each of these formats follow a standard to show dependencies, vulnerabilities and license information in an organized way. You can easily export a software bill of materials (SBOM) for your dependencies following these steps: 1. Within your group, navigate to **Inventory > Packages**. 1. Click on the **Export SBOM** button. Find the SBOM generation button on the Fluid Attacks platform

Find the SBOM generation button on the Fluid Attacks platform

1. Select whether you want an SBOM for packages in your Git repository or Docker images. Select SBOM report type on the Fluid Attacks platform

1. Select in which format you want to download the inventory of software dependencies: **CycloneDX** or **SPDX**. Choose SBOM format on the Fluid Attacks platform

Choose SBOM format on the Fluid Attacks platform

1. Select the file type for your SBOM: **JSON** or **XML**. Choose SBOM file type on the Fluid Attacks platform

1. Select the resources (repos or Docker images) related to the project(s) of which you want to generate the SBOM. The window only shows active resources. Generate project SBOM on the Fluid Attacks platform

Generate project SBOM on the Fluid Attacks platform

1. Click on **Generate**. 1. You then receive an email saying your SBOM is ready. Just go to the platform and click on **[Downloads](https://help.fluidattacks.com/portal/en/kb/articles/access-recent-downloads)** to access the download option. If you chose more than one root, you receive a separate email for each root. Download SBOM by Fluid Attacks

> [!TIP] > > **Note:** The SBOM may take up to 5 minutes to be ready for download. Keep in mind that the information provided may vary depending on the standard. The file may include the package name, version, location, license and dependency tree, which shows the primary and transitive dependencies. > [!NOTE] > > **Free trial** > Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your [21-day free trial](https://app.fluidattacks.com/SignUp) and discover the benefits of the [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) [Essential plan](https://fluidattacks.com/plans/). If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out [this contact form](https://fluidattacks.com/contact-us/).