Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management

Larissa Schmid, Diogo Gaspar, Raphina Liu, Sofia Bobadilla, Benoit Baudry, Martin Monperrus

Abstract

Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for detecting such smells in the supply chains of software packages. Through interviews with practitioners, we show that our proposed smells align with real-world concerns and capture signals considered valuable. A quantitative study of popular packages in the Maven and NPM ecosystems reveals that while smells are prevalent in both, they differ significantly across ecosystems, with traceability and signing issues dominating in Maven and most smells being rare in NPM, due to strong registry-level guarantees. Software supply chain smells support developers and organizations in making informed decisions and improving their software supply chain security posture.

Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management

Abstract

Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for detecting such smells in the supply chains of software packages. Through interviews with practitioners, we show that our proposed smells align with real-world concerns and capture signals considered valuable. A quantitative study of popular packages in the Maven and NPM ecosystems reveals that while smells are prevalent in both, they differ significantly across ecosystems, with traceability and signing issues dominating in Maven and most smells being rare in NPM, due to strong registry-level guarantees. Software supply chain smells support developers and organizations in making informed decisions and improving their software supply chain security posture.

Paper Structure

This paper contains 48 sections, 3 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Problem Statement
  3. Taxonomy of Software Supply Chain Smells
  4. Methodology
  5. Software Supply Chain Smells
  6. No Source Code URL
  7. Invalid Source Code URL
  8. Inaccessible Commit SHA/Release Tag
  9. Deprecated
  10. Fork
  11. No Code Signature
  12. Invalid Code Signature
  13. Aliased
  14. No Provenance
  15. Discussion
  16. ...and 33 more sections

Figures (3)

  • Figure 1: Workflow of Dirty-Waters. Based on the dependency tree of a project, it gathers analytics from the dependencies and the package registries, to generate a software supply chain smells report.
  • Figure 2: Excerpt of a Software Supply Chains smells report generated by Dirty-Waters.
  • Figure 3: Distribution of smells exhibited by packages directly. Note that the Deprecated, Aliased, and No Provenance smells are not supported for Maven.