Quantify the scale and severity of software supply chain attacks, map the dependency networks that create systemic risk, and assess the adequacy of current software composition analysis (SCA) and provenance verification frameworks.

Analysis of CVE database records (2015–2026) filtered for supply chain attacks. NTIA software bill of materials (SBOM) adoption tracking. Dependency network mapping from 50 major open-source projects. Cost analysis of supply chain incidents: SolarWinds, Log4j, Codecov, and npm left-pad case studies.

Supply chain attacks increased 300% between 2019 and 2024. The average software application contains 528 open-source dependencies, creating a vast attack surface. Only 4% of organizations can identify all third-party and open-source components in their software at any given time. The Log4j vulnerability affected ~3 billion devices and had estimated total cost of $1 trillion.

The npm left-pad incident (2016) — when a developer unpublished a 11-line package used by millions — demonstrated that the entire modern software ecosystem depends on volunteer maintenance of critical infrastructure. Malicious package injection attacks in npm have increased 5x since 2020.

Automated vulnerability scanning catches <20% of supply chain vulnerabilities because many attack vectors are behavioral (malware injected into compiled binaries) rather than code-detectable.