Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2026
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866914431280087040 |
|---|---|
| author | Schmid, Larissa Gaspar, Diogo Liu, Raphina Bobadilla, Sofia Baudry, Benoit Monperrus, Martin |
| author_facet | Schmid, Larissa Gaspar, Diogo Liu, Raphina Bobadilla, Sofia Baudry, Benoit Monperrus, Martin |
| contents | Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for detecting such smells in the supply chains of software packages. Through interviews with practitioners, we show that our proposed smells align with real-world concerns and capture signals considered valuable. A quantitative study of popular packages in the Maven and NPM ecosystems reveals that while smells are prevalent in both, they differ significantly across ecosystems, with traceability and signing issues dominating in Maven and most smells being rare in NPM, due to strong registry-level guarantees. Software supply chain smells support developers and organizations in making informed decisions and improving their software supply chain security posture. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2603_24282 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management Schmid, Larissa Gaspar, Diogo Liu, Raphina Bobadilla, Sofia Baudry, Benoit Monperrus, Martin Software Engineering Cryptography and Security Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for detecting such smells in the supply chains of software packages. Through interviews with practitioners, we show that our proposed smells align with real-world concerns and capture signals considered valuable. A quantitative study of popular packages in the Maven and NPM ecosystems reveals that while smells are prevalent in both, they differ significantly across ecosystems, with traceability and signing issues dominating in Maven and most smells being rare in NPM, due to strong registry-level guarantees. Software supply chain smells support developers and organizations in making informed decisions and improving their software supply chain security posture. |
| title | Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management |
| topic | Software Engineering Cryptography and Security |
| url | https://arxiv.org/abs/2603.24282 |