Software Supply Chain Security
The practices, tools, and policies that protect every stage of how software is built, distributed, and consumed
Also known as: Software Supply Chain Safety, Supply Chain Integrity
Category: Software Development
Tags: security, cybersecurity, supply-chain-attacks, software-development, devops
Explanation
Software supply chain security covers the practices, tools, and policies that protect every stage of how software is built, distributed, and consumed. Modern applications are composed of hundreds of dependencies, build tools, CI/CD pipelines, and distribution channels — each link is an attack surface.
The software supply chain spans from source code through dependencies, build systems, artifact registries, deployment, and runtime. An attacker can compromise any stage: source through compromised developer accounts or malicious commits, dependencies through typosquatting, dependency confusion, slopsquatting, or starjacking, builds through CI/CD pipeline compromise, distribution through registry account takeover, or runtime by exploiting vulnerabilities in deployed dependencies.
The urgency of supply chain security has grown dramatically. The average application has 200-500+ transitive dependencies. A single compromised dependency can affect millions of downstream projects, as demonstrated by incidents like the event-stream hijack, the colors.js/faker.js sabotage, and the xz-utils backdoor. AI-assisted coding and autonomous agents that install dependencies without human review have created entirely new attack vectors like slopsquatting.
Defense requires multiple layers: Software Bill of Materials (SBOM) for machine-readable component inventories, Software Composition Analysis (SCA) for automated vulnerability and malware scanning, code signing and provenance verification through tools like Sigstore, lockfile discipline with pinned versions, package registry security features like scoped namespaces and publisher verification, and applying the principle of least privilege to CI/CD and AI agents.
Key frameworks and standards include SLSA (Supply chain Levels for Software Artifacts) from Google, the OpenSSF Scorecard for automated security health assessment, NIST's Secure Software Development Framework (SSDF), and the EU Cyber Resilience Act requiring SBOM and vulnerability handling.
Related Concepts
← Back to all concepts