Theses›Software & applications›Software supply-chain integrity

Software supply-chain integrity

Proving the code you run is the code that was built becomes a required control, and the code hosts give most of it away

  • Bear
  • Open
  • $31B by 2035

The callThe attackers are winning today: poisoned packages and hijacked update servers hit three widely used tools in October 2026, and EU rules make build integrity a required control from December 2027. The window is open, though the code hosts give the core signing away.

D1D2D3R1R2R3C1C2C3foragainst D1D2D3R1R2R3C1C2C3foragainst
Fig. 1The balance. Drivers and catalysts against restraints, each block sized by its weight; catalysts hang dashed because they have not happened yet, sized by their odds. It tips toward the restraints.
  1. D1In October 2026 a popular AI proxy package was poisoned on PyPI and Docker, OVHcloud's command-line tool shipped a stealer from a hijacked developer account, and a backup vendor's update servers handed out a backdoor, all routes signed build provenance would have flagged.
  2. D2The EU Cyber Resilience Act's full obligations from 11 Dec 2027 make manufacturers handle vulnerabilities across the components they ship, which turns provenance and component inventories into a conformity cost.
  3. D3AI tooling multiplies dependencies and stolen developer credentials are cheap, so the number of packages an attacker can poison keeps growing.
  4. R1Sigstore is an open standard and GitHub ships artifact attestations for free, so the core fix earns nobody money.
  5. R2JFrog, Sonatype and Snyk already hold much of the paid layer, and the slice open to newcomers is about $1.8B on the high estimate and under $1B on the low ones.
  6. R3GitHub could absorb package risk scoring the way it absorbed secret scanning.
  7. C1EU CRA full obligations apply, making provenance and component inventories a conformity cost for manufacturers.11 Dec 2027
  8. C2EU CRA harmonised standards name signed build provenance or an equivalent as part of conformity.31 Dec 2027
  9. C3Another month with three or more public compromises of packages or tools each downloaded over a million times a week.31 Dec 2027
Rests onthe beliefs underneath
Supported by · confidence
What would prove itdated tests, open and resolved
20272028today1234predictionswatch 20272028today1234predictionswatch
Fig. 2Each ring is a dated test: dashed while open, struck through when overdue, ticked or crossed once resolved.
  1. 1Through 2027 there is at least one month with three or more publicly reported compromises of packages or tools each downloaded more than one million times a week, as in October 2026.Dec 2027 · open
  2. 2By 31 Dec 2027 the EU CRA harmonised standards name signed build provenance or an equivalent as part of conformity.Dec 2027 · open
  3. 3Whether October 2026's three large compromises in one month repeat.Dec 2027 · open
  4. 4Whether GitHub adds package risk scoring before install.Dec 2027 · open
Expressionslisted, private, technologies
What changedthe record, newest first
  • 23 Oct 2026Three poisoned software updates in one month, all of which signed build provenance would have flagged. The signing is free; the money is in components someone rebuilds clean every day.