Summary
Software today relies a lot on pieces made by others, and this can cause security problems because bad actors might attack these pieces. The authors say that current ways to measure these risks don’t work well across different software communities and miss important details about how problems spread through connections between pieces. They want to create a better, unified way to look at all these connections so we can understand risks more clearly. They also point out that new AI tools used to write code are changing how these dependencies form, which makes old security measurement tools less effective. This means we need fresh ideas to keep software safe as these new technologies change the way software is built.
software supply chainthird-party dependenciesvulnerability managementdependency modelingtransitive dependenciesSoftware Composition Analysis (SCA)AI-assisted software developmentcoding large language models (LLMs)exploitabilitycross-ecosystem analysis
Abstract
Software supply chain security has become increasingly critical due to the widespread reliance on third-party dependencies and the growing attack surface of modern software ecosystems. However, existing quantitative, measurement-based analysis and vulnerability management approaches remain largely fragmented and ecosystem-specific, limiting their ability to provide comparable risk assessments across environments. This paper presents a structured research plan, starting with a Systematization of Knowledge (SoK) to synthesize the current state of research and identify key gaps, highlighting the limitations in dependency modeling and vulnerability propagation analysis, particularly in the treatment of transitive dependencies and their real-world exploitability. Based on these insights, we argue for a unified measurement perspective capable of consistently representing and analyzing the cross-ecosystem dependency structure. We further identify emerging challenges introduced by AI-assisted software development, where coding LLMs are likely to contribute to new dependency patterns that are not captured by traditional Software Composition Analysis (SCA) tools. These shifts motivate a rethink of dependency modeling to account for evolving software-generation practices and their long-term structural impact on software security.