Skip to content

Software Quality

Supply-chain hygiene

Supply-chain hygiene is the set of practices that keep a project's dependencies from becoming a delivery channel for attackers. Those dependencies are most of the program: a typical npm application pulls thousands of transitive ones, few of them chosen directly. The discipline covers what is in the build (Software Bill of Materials), what is known to be wrong in it (Software Composition Analysis), what is trusted (signing, attestation), and whether it can be re-created (reproducible builds).

What it catches

  • Known-vulnerable dependencies. A library in the lockfile matches a CVE; the tool reports it.
  • License risk. A dependency relicensed under a copyleft variant the project cannot ship; license-scan tools flag it.
  • Stale dependencies. Pinned versions years out of date, shipping known bugs whose fixes are already public.
  • Typosquatting and dependency confusion. Packages with names one character off from real packages, or with names that resolve in the wrong registry; some scanners catch these.
  • Build provenance gaps. Artifacts shipping with no record of what built them, how, when, from which sources.
  • Unsigned artifacts. Binaries downloaded without signature verification make any compromise of the distribution channel fatal.
  • Non-reproducible builds. Two builds from the same source producing different binaries means the build environment is part of the trust base, and any change there is an unaudited modification.

What supply-chain hygiene does not catch by itself: novel backdoors that aren't yet in any CVE feed (the xz-utils backdoor sat in the build chain unflagged for nearly two years before disclosure), malicious behavior of a dependency that the scanner has not been told to look for, and vulnerabilities in the project's own first-party code.

Tools

Dependency scanning (SCA)

  • Dependabot (GitHub-native) — automatic PRs for vulnerable and outdated dependencies; supports most ecosystems.
  • Renovate — Dependabot alternative; finer control, broader ecosystem coverage.
  • Snyk, Sonatype Nexus IQ, Mend, JFrog Xray — commercial SCA + license scan + policy.
  • OSV-Scanner (Google) — open-source CLI; reads osv.dev advisory feeds; supports many ecosystems.
  • Trivy (Aqua Security) — open-source; scans containers, filesystems, repos, SBOMs.
  • Grype (Anchore) — open-source vulnerability scanner; pairs with Syft.

Update automation and cooldowns

Dependabot and Renovate also apply updates, not only report them — and the popular "auto-merge patch versions on green CI" policy is itself a supply-chain risk. Green CI does not catch a hijacked-maintainer release: ua-parser-js (GitHub Advisory Database 2021)1, the node-ipc protestware (NIST National Vulnerability Database 2022)2, and event-stream (GitHub Advisory Database 2018)3 each shipped malware in a patch/minor that passed every test while running a malicious install script or exfiltrating secrets, and auto-merge lands it with no human in the loop. The fix that keeps the automation is a release-age cooldown — adoption is deferred until a release has been public a few days, by which point most malicious releases have been reported and yanked:

  • Renovate — minimumReleaseAge (e.g. "3 days"), enforced as a merge gate with internalChecksFilter: "strict".
  • Dependabot — the cooldown option (generally available July 2025), with per-bump semver-patch-days / semver-minor-days / semver-major-days.

The cooldown works alongside a committed lockfile carrying integrity hashes, with install scripts disabled or allowlisted — the main remote-code path at install time (npm ci --ignore-scripts, or pnpm's onlyBuiltDependencies). Security updates are exempt from the cooldown, so a fix for a known CVE is never delayed.

SBOM generation

  • Syft (Anchore) — open-source; emits SPDX or CycloneDX.
  • cdxgen (OWASP) — CycloneDX SBOMs for many ecosystems.
  • sbom-tool (Microsoft) — SPDX SBOMs.
  • Go modules, cargo-cyclonedx, pip-audit — ecosystem-native tooling.

Signing and attestation

  • Sigstore — open-source signing infrastructure.
  • cosign — signs container images and arbitrary artifacts.
  • in-toto — supply-chain attestations.
  • SLSA (Supply-chain Levels for Software Artifacts) — the framework; build levels L0–L3 grade an artifact's build provenance.
  • SPIFFE / SPIRE — workload identity, signed at run-time.

Reproducible builds

Advisory databases (the data behind the scanners)

When to use, when not

Use:

  • Every project that ships software people install or run. The minimum bar is SCA + automated dependency PRs (Dependabot or Renovate).
  • Container-shipping projects: SBOM at build, image scan, signed images. The SLSA framework names the maturity levels to climb.
  • Projects in security-sensitive industries (finance, health, defense). Many have legal requirements (US Executive Order 14028 introduced SBOM requirements for federal procurement (Executive Order 14028 2021)4).
  • Open-source projects that other code depends on. The blast radius of an upstream compromise is whoever installs your package.

Don't:

  • As a substitute for in-house security work. SCA reports known CVEs in known dependencies; unknown CVEs and your own bugs need threat modeling, static analysis, fuzzing, and code review.
  • Without a remediation policy. Reports nobody reads are noise.
  • Without distinguishing development from runtime dependencies. A dev-only CVE is not a runtime risk; loud failures for dev-only findings train teams to ignore the tool.

Evidence

  • xz-utils backdoor (CVE-2024-3094, March 2024). Industry-wide demonstration that human-level social engineering of an upstream maintainer is a viable attack path. The compromise sat in distributed release tarballs; what flagged it was a developer noticing a ~500 ms regression in SSH logins (Freund 2024)5 — not any dependency-scanning tool.
  • SolarWinds (2020). Build-time injection of malicious code via the build infrastructure; the highest-profile demonstration that the build environment is part of the attack surface (Cybersecurity and Infrastructure Security Agency (CISA) 2020)6.
  • Sonatype State of the Software Supply Chain. Annual industrial telemetry on dependency CVEs and the gap between vulnerable-component disclosure and end-user patching (Sonatype 2024)7.
  • SLSA framework (originated at Google, now a Linux Foundation / OpenSSF specification). Its build levels are derived from real attack patterns (SLSA 2023)8.
  • OpenSSF Scorecard — automated scoring of open-source projects against around two dozen hygiene checks; the data feeds dependency selection.

The empirical case for supply-chain hygiene is built from incidents rather than controlled studies.

Classification

  • Quality dimensions: Security, Maintainability.
  • Area: Build artifacts and containers; open-source-heavy ecosystems (npm, PyPI, Cargo, Maven, Go modules); regulated industries with SBOM mandates.
  • Guarantee: Empirical — vulnerabilities reported in the upstream feed are flagged; those not yet reported are not.

Referenced by

References

  1. GitHub Advisory Database. 2021. Embedded Malware in ua-parser-js. GitHub Advisory GHSA-pjwm-rvh2-c87w (CVE-2021-4229). https://github.com/advisories/GHSA-pjwm-rvh2-c87w. ↩

  2. NIST National Vulnerability Database. 2022. CVE-2022-23812: Malicious Code in node-ipc. NVD. https://nvd.nist.gov/vuln/detail/CVE-2022-23812. ↩

  3. GitHub Advisory Database. 2018. Critical Severity Vulnerability Affecting event-stream and flatmap-stream. GitHub Advisory GHSA-mh6f-8j2x-4483. https://github.com/advisories/GHSA-mh6f-8j2x-4483. ↩

  4. Executive Order 14028. 2021. Improving the Nation's Cybersecurity. https://www.govinfo.gov/content/pkg/FR-2021-05-17/html/2021-10460.htm. ↩

  5. Freund, Andres. 2024. Backdoor in Upstream xz/liblzma Leading to SSH Server Compromise. Oss-security mailing list. https://www.openwall.com/lists/oss-security/2024/03/29/4. ↩

  6. Cybersecurity and Infrastructure Security Agency (CISA). 2020. Emergency Directive 21-01: Mitigate SolarWinds Orion Code Compromise. https://www.cisa.gov/news-events/directives/ed-21-01-mitigate-solarwinds-orion-code-compromise-closed. ↩

  7. Sonatype. 2024. 2024 State of the Software Supply Chain. https://www.sonatype.com/hubfs/SSCR-2024/SSCR_2024-FINAL-10-10-24.pdf. ↩

  8. SLSA. 2023. Supply-chain Levels for Software Artifacts: Specification v1.0 — Security Levels. The Linux Foundation. https://slsa.dev/spec/v1.0/levels. ↩