What is supply-chain risk in frontend applications?

Short interview answer

Build dependencies and third-party scripts execute with significant trust. Pin and review updates, minimize dependencies, use lockfiles and automated advisories, protect publishing credentials, restrict runtime third parties with CSP, and maintain an incident response path. An audit command alone is not a complete program.