Software agent tracks third-party components across development stages
From Component Snapshots to Lifecycle Traces: Agent-Based Software Composition Analysis
Software Engineering
Summary
Knowing exactly which third-party software pieces are used and how they change throughout development is hard. Existing tools look at only one point in the software's life, missing the full story. The authors created SCA-Agent, a tool that follows components from coding through to running the software, gathering clues at each stage. It helps identify component versions, origins, and changes better than previous methods. This gives a clearer picture of software risks from third-party parts.
What this means in practice
- •For software security teams: Identify and track vulnerable third-party software components throughout the entire development and deployment process to improve risk assessments.
- •For devops engineers: Gain detailed insights into how components flow from code to runtime, enabling more accurate troubleshooting and lifecycle management.
Authors
Chaofan Li, Zhengduo Xue, Chengxiang Li, Yutao Hu, Yueming Wu, Deqing Zou
Abstract
Software supply-chain security requires accurate identification of third-party components and an understanding of how they evolve from development to execution. Existing software composition analysis (SCA) approaches examine manifests, build environments, release artifacts, containers, or runtime states, but typically produce only stage-specific views of software composition. As dependencies are resolved, removed, repackaged, and transformed across lifecycle stages, a single snapshot cannot capture both where a component originates and where it ultimately ends up. Combining snapshots from multiple stages still leaves their cross-stage relationships unresolved. We present SCA-Agent, an agent-based approach to lifecycle-aware SCA that reconstructs evidence-backed component lifecycle traces across Code, Build, Release, Deploy, and Runtime. SCA-Agent adaptively explores project-specific analysis paths, gathers stage-specific evidence, and correlates observations across stages to recover component identities, versions, introduction paths, propagation relationships, and final lifecycle states. We evaluate SCA-Agent on 105 real-world projects from the Java, JavaScript, and Python ecosystems. SCA-Agent achieves the highest component detection F1 across all lifecycle stages and ecosystems. For vulnerability exposure assessment, it reaches an F1 score of 96.69%, exceeding the best traditional SCA tool by 18.76 percentage points. These results show that lifecycle-aware SCA supports traceable component provenance and more accurate software supply-chain risk assessment.