Open Source and Open Targets: A Comprehensive Analysis of Software Supply Chain Attacks in Open-Source Software

Software supply chain attacks pose a significant threat to organizations worldwide. Open-source software enables threat actors to amplify the impact further, and it creates unique challenges for organizations using Open-Source Software (OSS). OSS-based supply chain attacks have a cascading impact, unlike a targeted attack on an organization. This paper provides a comprehensive analysis of OSS-based software supply chain attacks from 2010 to 2022. An empirical analysis was performed on the datasets available in the public domain. Advanced clustering analysis are used to identify distinct patterns in attack vectors, code base types, and distribution vectors. The study highlights the diverse methods and targets of OSS-based supply chain attacks. The findings from the analysis aim to empower security professionals with insights about the trends. They will be useful in determining the focus areas when attempting to bolster defense against software supply chain attacks. The paper also dives into the frameworks available for organizations to measure their maturity of defenses against supply chain attacks and covers actionable mitigation strategies to bolster their defense against such attacks.