Most of the code actually running in your Node service is stuff you didn't write. How do you manage that supply-chain risk?

Yeah, so in Node most of your code comes from dependencies, so this matters a lot. The basics would be, commit a lockfile so everyone installs the same versions, and use npm ci in CI so installs are reproducible. Run npm audit to find known vulnerabilities in your dependencies and update the affected packages. You want to keep dependencies fairly current, but review the updates instead of just upgrading blindly. And be careful adding new ones in the first place, prefer well-maintained, widely used packages and keep the count small, since each one is code you're trusting. There's also typosquatting, where a malicious package sits on a name really close to a popular one. Tools like Dependabot or Snyk can automate the vulnerability detection part. Basically the goal is to reduce and monitor how much untrusted third-party code is running in your service.