Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management
This addresses software supply chain security for developers and organizations, offering a lightweight analysis approach that is incremental to existing dependency management practices.
The paper tackles software supply chain security by introducing 'software supply chain smells' as structural indicators of potential security risks, and presents Dirty-Waters, a tool for detecting these smells. A study of Maven and NPM packages found smells are prevalent but differ across ecosystems, with traceability/signing issues dominating in Maven and being rare in NPM due to registry-level guarantees.
Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for detecting such smells in the supply chains of software packages. Through interviews with practitioners, we show that our proposed smells align with real-world concerns and capture signals considered valuable. A quantitative study of popular packages in the Maven and NPM ecosystems reveals that while smells are prevalent in both, they differ significantly across ecosystems, with traceability and signing issues dominating in Maven and most smells being rare in NPM, due to strong registry-level guarantees. Software supply chain smells support developers and organizations in making informed decisions and improving their software supply chain security posture.