Supply Chain Risk Analysis Via SBOM Data Enrichment

The attempt to backdoor SSH via an infiltration operation in one of its dependencies, namely the XZ library, illustrated the importance of robust software supply chain security. One of the tools to achieve this objective is software bill of materials (SBOM). In this paper, we proposed enriching data from our internal SBOM tooling with maintenance-related metadata from GitHub and Node Package Manager (npm) repositories to get a better understanding of our supply chain, regarding its susceptibility to XZ-type infiltration. We defined several features that we believed contributed to this risk and calculated a risk metric to identify the most extreme cases to test the validity of our approach. In doing so, we did not identify any case of supply chain attacks but identified libraries that could be susceptible to it. In addition, during the data analysis we encountered several cases where developers were making seemingly irrational tradeoffs between productivity gains and technical debt, including cyber security risks.