Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management

TL;DR

This paper introduces the concept of software supply chain smells as indicators of security risks, and presents Dirty-Waters, a tool to detect these smells in package dependencies.

Contribution

It defines supply chain smells, designs a detection tool, and evaluates their prevalence and significance across Maven and NPM ecosystems.

Findings

Smells are common in both Maven and NPM but differ significantly.

Traceability and signing issues are prevalent in Maven.

NPM exhibits fewer smells due to strong registry guarantees.

Abstract

Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for detecting such smells in the supply chains of software packages. Through interviews with practitioners, we show that our proposed smells align with real-world concerns and capture signals considered valuable. A quantitative study of popular packages in the Maven and NPM ecosystems reveals that while smells are prevalent in both, they differ significantly across ecosystems, with traceability and signing issues dominating in Maven and most smells being rare in NPM, due to strong registry-level guarantees. Software supply chain smells support developers and organizations in making informed decisions and improving their software supply chain security posture.