Software supply chain and SBOM

In short: Modern software consists mostly of third-party libraries. Supply-chain attacks smuggle malicious code in through such dependencies or build tools. An SBOM lists all components.

In more detail: An application often depends on hundreds, indirectly thousands, of packages. If one is compromised (hijacked account, typo package, tampered build), every user inherits the problem. Examples are SolarWinds and Log4Shell.

In Depth

• SBOM: Software bill of materials, an ingredients list (formats CycloneDX, SPDX).
• Typosquatting: Packages with almost the same name as well-known ones.
• Dependency confusion: An internal package is replaced by a public one of the same name.
• Measures: Lockfiles, pinning versions, integrity hashes, monitored updates (Dependabot), vulnerability scans, minimal dependencies.
• Reproducible builds: Same source produces a bit-identical binary.
• Signed artefacts and provenance: Sigstore/cosign, SLSA levels.
• Securing CI/CD: Protect secrets, limit pipeline permissions.

See also: OWASP Top 10, Container security