software supply chain security teams

Abstract: The construction industry increasingly relies on software built from third-party components, yet the dependency composition and known-vulnerability exposure of construction-related software remain poorly analyzed. In this study, we conduct an empirical, cross-ecosystem investigation of 904 construction-related GitHub repositories spanning six construction functions and a multifunction category. Using commit-pinned repository snapshots and OSV-Scanner, we examine dependency assessability, known-vulnerability prevalence, severity, weakness classifications, and shared upstream exposure. Our results reveal that only 494 repositories (54.6%) completed vulnerability assessment, revealing substantial gaps in dependency visibility. Among successfully scanned repositories, 395 (80.0%) contained at least one dependency version associated with a published vulnerability advisory, and 97.2% of affected repositories contained a High or Critical severity risk. Additionally, Common Weakness Enumeration (CWE) mapping identified recurring resource-consumption, path-traversal, information-exposure, and code-injection weaknesses. Vulnerability burden was uneven, with a median of 50 distinct advisory clusters per affected repository, while just two affected upstream package families collectively reached ~70% of affected repositories. These findings establish an empirical baseline for dependency assessability and known-vulnerability exposure in construction-related open-source software. Our findings underscore the importance of documenting assessment coverage, interpreting advisory matches in their deployment context, and examining shared upstream dependencies when evaluating construction software supply-chain security.

Abstract: Source-code watermarking supports provenance tracking by embedding a recoverable identifier in a software artifact. Many existing approaches encode this identifier in tokens or program syntax, exposing the watermark to transformations that modify the source text. We present PlaceMark, a blind watermarking system that encodes a payload in the placement of modules within a repository. Each eligible module is identified by its filename and top-level definition names. A secret key determines its ordered candidate destinations and its position in the reading order; the module's location within its candidate list determines the encoded symbol. Embedding relocates selected modules and updates their import references. Extraction uses the distributed repository, the key, and agreed decoding parameters, without an original copy or placement ledger. Capacity measurements on ten Python repositories yield nominal capacities of 249 to 2,166 bits in nine repositories, while one provides no placement channel. In 216 trials of the evaluated text transformations, the payload is recovered exactly. Relocation degrades recovery gradually on Django, Airflow and Salt, while on Pylint a path-based exclusion in our implementation lets relocation change carrier membership, and we measure it for an untargeted adversary and for one that concentrates its budget on the public carrier set. Changes to filenames or definition names alter the identity input and are measured separately. Exact recovery also depends on placement feasibility. The results characterize module placement as a carrier that can complement watermarks embedded in source text.