Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The authors establish a research agenda and Systematization of Knowledge (SoK) targeting the fragmentation of quantitative security metrics across disparate software supply chain ecosystems. This synthesis identifies critical blind spots in modeling transitive dependency exploitability and highlights how AI-assisted software generation is altering dependency topologies. Ultimately, the work defines a unified measurement framework to evaluate vulnerability propagation across cross-ecosystem architectures and AI-generated codebases.
Standard Software Composition Analysis tools are functionally blind to the novel, shifting dependency topologies generated by coding LLMs.
Software supply chain security has become increasingly critical due to the widespread reliance on third-party dependencies and the growing attack surface of modern software ecosystems. However, existing quantitative, measurement-based analysis and vulnerability management approaches remain largely fragmented and ecosystem-specific, limiting their ability to provide comparable risk assessments across environments. This paper presents a structured research plan, starting with a Systematization of Knowledge (SoK) to synthesize the current state of research and identify key gaps, highlighting the limitations in dependency modeling and vulnerability propagation analysis, particularly in the treatment of transitive dependencies and their real-world exploitability. Based on these insights, we argue for a unified measurement perspective capable of consistently representing and analyzing the cross-ecosystem dependency structure. We further identify emerging challenges introduced by AI-assisted software development, where coding LLMs are likely to contribute to new dependency patterns that are not captured by traditional Software Composition Analysis (SCA) tools. These shifts motivate a rethink of dependency modeling to account for evolving software-generation practices and their long-term structural impact on software security.