Shadows in the Supply Chain: Assessing Security Gaps in Third‑Party Dependencies

Modern software supply chains are dense, dynamic webs of third‑party packages, container layers, and infrastructure‑as‑code templates. While these dependencies super‑charge developer productivity, they also create “shadow” risk: latent vulnerabilities or malicious implants that may be several transitive hops away from any manifest file. In this paper we present the first cross‑ecosystem, end‑to‑end measurement of supply‑chain risk covering N = 1.1 million packages and 47,000 public CI/CD pipelines across JavaScript (npm), Python (PyPI) and Java (Maven Central). Our study reveals that 82% of popular GitHub projects import at least one package with a known CVE, and 29% inherit a critical CVE (CVSS ≥ 9.0) through three or more transitive edges. We further identify 1,735 confirmed malicious package versions released between 2019–2024, and we quantify common CI misconfigurations—such as unpinned action digests and over‑permissive tokens—that allow adversaries to weaponize benign dependencies at build time. To prioritize remediation, we introduce ML‑SCAR, a multi‑layer risk‑scoring framework that fuses static call‑graph reachability, dynamic taint‑flow coverage, and probabilistic vulnerability propagation. ML‑SCAR boosts Precision@10% to 0.67 (baseline 0.28) and Recall@50% to 0.88 (baseline 0.55) on a hand‑labeled exploit dataset. We conclude with a defense framework—Zero‑Trust‑in‑Build pipelines, continuous SBOM validation, and ML‑assisted registry vetting—that can reduce real‑world vulnerable artifacts by 41% in our evaluation environment.