Dirty-Waters: Detecting Software Supply Chain Smells

Abstract

Using open-source dependencies is essential in modern software development. However, this practice implies significant trust in third-party code, while there is little support for developers to assess this trust. As a consequence, attacks have been increasingly occurring through third-party dependencies. These are called software supply chain attacks. In this talk, we will introduce the novel concept of software supply chain smell and present DIRTY-WATERS, a tool for detecting software supply chain smells. We will also demonstrate the prevalence of all proposed software supply chain smells.