# Supply-chain hygiene Supply-chain hygiene is the set of practices that keep a project's dependencies from becoming a delivery channel for attackers. Those dependencies are most of the program: a typical npm application pulls thousands of transitive ones, few of them chosen directly. The discipline covers *what is in the build* (Software Bill of Materials), *what is known to be wrong in it* (Software Composition Analysis), *what is trusted* (signing, attestation), and *whether it can be re-created* (reproducible builds). ## What it catches - **Known-vulnerable dependencies.** A library in the lockfile matches a CVE; the tool reports it. - **License risk.** A dependency relicensed under a copyleft variant the project cannot ship; license-scan tools flag it. - **Stale dependencies.** Pinned versions years out of date, shipping known bugs whose fixes are already public. - **Typosquatting and dependency confusion.** Packages with names one character off from real packages, or with names that resolve in the wrong registry; some scanners catch these. - **Build provenance gaps.** Artifacts shipping with no record of what built them, how, when, from which sources. - **Unsigned artifacts.** Binaries downloaded without signature verification make any compromise of the distribution channel fatal. - **Non-reproducible builds.** Two builds from the same source producing different binaries means the build environment is part of the trust base, and any change there is an unaudited modification. What supply-chain hygiene does **not** catch by itself: novel backdoors that aren't yet in any CVE feed (the xz-utils backdoor sat in the build chain unflagged for nearly two years before disclosure), malicious *behavior* of a dependency that the scanner has not been told to look for, and vulnerabilities in the project's own first-party code. ## Tools ### Dependency scanning (SCA) - **[Dependabot](https://github.com/dependabot/dependabot-core)** (GitHub-native) — automatic PRs for vulnerable and outdated dependencies; supports most ecosystems. - **[Renovate](https://docs.renovatebot.com/)** — Dependabot alternative; finer control, broader ecosystem coverage. - **Snyk**, **Sonatype Nexus IQ**, **Mend**, **JFrog Xray** — commercial SCA + license scan + policy. - **[OSV-Scanner](https://github.com/google/osv-scanner)** (Google) — open-source CLI; reads `osv.dev` advisory feeds; supports many ecosystems. - **[Trivy](https://trivy.dev/)** (Aqua Security) — open-source; scans containers, filesystems, repos, SBOMs. - **[Grype](https://github.com/anchore/grype)** (Anchore) — open-source vulnerability scanner; pairs with Syft. ### Update automation and cooldowns **Dependabot** and **Renovate** also *apply* updates, not only report them — and the popular "auto-merge patch versions on green CI" policy is itself a supply-chain risk. Green CI does not catch a hijacked-maintainer release: ua-parser-js (GitHub Advisory Database 2021)[^uaparserjs2021], the node-ipc protestware (NIST National Vulnerability Database 2022)[^nodeipc2022], and event-stream (GitHub Advisory Database 2018)[^eventstream2018] each shipped malware in a patch/minor that passed every test while running a malicious install script or exfiltrating secrets, and auto-merge lands it with no human in the loop. The fix that keeps the automation is a **release-age cooldown** — adoption is deferred until a release has been public a few days, by which point most malicious releases have been reported and yanked: - **Renovate** — `minimumReleaseAge` (e.g. `"3 days"`), enforced as a merge gate with `internalChecksFilter: "strict"`. - **Dependabot** — the `cooldown` option (generally available July 2025), with per-bump `semver-patch-days` / `semver-minor-days` / `semver-major-days`. The cooldown works alongside a committed lockfile carrying integrity hashes, with install scripts disabled or allowlisted — the main remote-code path at install time (`npm ci --ignore-scripts`, or pnpm's `onlyBuiltDependencies`). Security updates are exempt from the cooldown, so a fix for a known CVE is never delayed. ### SBOM generation - **[Syft](https://github.com/anchore/syft)** (Anchore) — open-source; emits SPDX or CycloneDX. - **[cdxgen](https://github.com/CycloneDX/cdxgen)** (OWASP) — CycloneDX SBOMs for many ecosystems. - **[sbom-tool](https://github.com/microsoft/sbom-tool)** (Microsoft) — SPDX SBOMs. - **Go modules**, **[cargo-cyclonedx](https://github.com/CycloneDX/cyclonedx-rust-cargo)**, **[pip-audit](https://github.com/pypa/pip-audit)** — ecosystem-native tooling. ### Signing and attestation - **[Sigstore](https://www.sigstore.dev/)** — open-source signing infrastructure. - **[cosign](https://github.com/sigstore/cosign)** — signs container images and arbitrary artifacts. - **[in-toto](https://in-toto.io/)** — supply-chain attestations. - **[SLSA](https://slsa.dev/)** (Supply-chain Levels for Software Artifacts) — the framework; build levels L0–L3 grade an artifact's build provenance. - **[SPIFFE](https://spiffe.io/) / [SPIRE](https://github.com/spiffe/spire)** — workload identity, signed at run-time. ### Reproducible builds - **[reproducible-builds.org](https://reproducible-builds.org/)** — the umbrella project. - **[diffoscope](https://diffoscope.org/)** — diff two builds to find sources of non-determinism. - **[Bazel](https://bazel.build/)** with hermetic configuration; **[Nix](https://nixos.org/)** / **[Guix](https://guix.gnu.org/)**. ### Advisory databases (the data behind the scanners) - **[GitHub Advisory Database](https://github.com/advisories)**. - **[OSV.dev](https://osv.dev/)** — Google's open vulnerability database. - **[NVD](https://nvd.nist.gov/)** (NIST National Vulnerability Database). - **[RustSec advisory-db](https://rustsec.org/)**, **[PyPI Advisory Database](https://github.com/pypa/advisory-database)**. ## When to use, when not **Use:** - Every project that ships software people install or run. The minimum bar is SCA + automated dependency PRs (Dependabot or Renovate). - Container-shipping projects: SBOM at build, image scan, signed images. The SLSA framework names the maturity levels to climb. - Projects in security-sensitive industries (finance, health, defense). Many have *legal* requirements (US Executive Order 14028 introduced SBOM requirements for federal procurement (Executive Order 14028 2021)[^executiveorder140282021]). - Open-source projects that other code depends on. The blast radius of an upstream compromise is whoever installs your package. **Don't:** - As a substitute for in-house security work. SCA reports known CVEs in known dependencies; unknown CVEs and your own bugs need [threat modeling](https://quality.stereobooster.com/threat-modeling.md), [static analysis](https://quality.stereobooster.com/static-analysis.md), [fuzzing](https://quality.stereobooster.com/fuzzing.md), and code review. - Without a remediation policy. Reports nobody reads are noise. - Without distinguishing development from runtime dependencies. A dev-only CVE is not a runtime risk; loud failures for dev-only findings train teams to ignore the tool. ## Evidence - **xz-utils backdoor (CVE-2024-3094, March 2024).** Industry-wide demonstration that *human-level social engineering* of an upstream maintainer is a viable attack path. The compromise sat in distributed release tarballs; what flagged it was a developer noticing a ~500 ms regression in SSH logins (Freund 2024)[^freund2024] — not any dependency-scanning tool. - **SolarWinds (2020).** Build-time injection of malicious code via the build infrastructure; the highest-profile demonstration that the *build environment* is part of the attack surface (Cybersecurity and Infrastructure Security Agency (CISA) 2020)[^cisa2020]. - **Sonatype State of the Software Supply Chain.** Annual industrial telemetry on dependency CVEs and the gap between vulnerable-component disclosure and end-user patching (Sonatype 2024)[^sonatype2024]. - **SLSA framework** (originated at Google, now a Linux Foundation / OpenSSF specification). Its build levels are derived from real attack patterns (SLSA 2023)[^slsa2023]. - **[OpenSSF Scorecard](https://github.com/ossf/scorecard)** — automated scoring of open-source projects against around two dozen hygiene checks; the data feeds dependency selection. The empirical case for supply-chain hygiene is built from incidents rather than controlled studies. ## Classification - **Quality dimensions:** Security, Maintainability. - **Area:** Build artifacts and containers; open-source-heavy ecosystems (npm, PyPI, Cargo, Maven, Go modules); regulated industries with SBOM mandates. - **Guarantee:** Empirical — vulnerabilities reported in the upstream feed are flagged; those not yet reported are not. ## Referenced by - [Quality dimensions](https://quality.stereobooster.com/quality-dimensions.md) · Quality dimensions - [Threat modeling](https://quality.stereobooster.com/threat-modeling.md) · Methods - [Verifying time and date handling](https://quality.stereobooster.com/time-and-date.md) · Methods - [How AI fits into software quality](https://quality.stereobooster.com/ai.md) · AI - [Choosing methods](https://quality.stereobooster.com/choosing.md) · Overview ## References [^uaparserjs2021]: GitHub Advisory Database. 2021. *[Embedded Malware in ua-parser-js](https://github.com/advisories/GHSA-pjwm-rvh2-c87w)*. GitHub Advisory GHSA-pjwm-rvh2-c87w (CVE-2021-4229). . [^nodeipc2022]: NIST National Vulnerability Database. 2022. *[CVE-2022-23812: Malicious Code in node-ipc](https://nvd.nist.gov/vuln/detail/CVE-2022-23812)*. NVD. . [^eventstream2018]: GitHub Advisory Database. 2018. *[Critical Severity Vulnerability Affecting event-stream and flatmap-stream](https://github.com/advisories/GHSA-mh6f-8j2x-4483)*. GitHub Advisory GHSA-mh6f-8j2x-4483. . [^executiveorder140282021]: Executive Order 14028. 2021. *[Improving the Nation's Cybersecurity](https://www.govinfo.gov/content/pkg/FR-2021-05-17/html/2021-10460.htm)*. . [^freund2024]: Freund, Andres. 2024. *[Backdoor in Upstream xz/liblzma Leading to SSH Server Compromise](https://www.openwall.com/lists/oss-security/2024/03/29/4)*. Oss-security mailing list. . [^cisa2020]: Cybersecurity and Infrastructure Security Agency (CISA). 2020. *[Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise](https://www.cisa.gov/news-events/directives/ed-21-01-mitigate-solarwinds-orion-code-compromise-closed)*. . [^sonatype2024]: Sonatype. 2024. *[2024 State of the Software Supply Chain](https://www.sonatype.com/hubfs/SSCR-2024/SSCR_2024-FINAL-10-10-24.pdf)*. [https://www.sonatype.com/hubfs/SSCR-2024/SSCR\\\_2024-FINAL-10-10-24.pdf](https://www.sonatype.com/hubfs/SSCR-2024/SSCR\_2024-FINAL-10-10-24.pdf). [^slsa2023]: SLSA. 2023. *[Supply-chain Levels for Software Artifacts: Specification v1.0 — Security Levels](https://slsa.dev/spec/v1.0/levels)*. The Linux Foundation. . ## Acronyms - SBOM — software bill of materials - SCA — software composition analysis