Measuring the Security of the Evolving Software Supply Chain: a Research Agenda

RESUMO

Software supply chain security has become increasingly critical due to reliance on third-party dependencies, but existing measurement approaches remain fragmented and ecosystem-specific. This paper presents a research agenda for a unified measurement perspective, and identifies emerging challenges introduced by AI-assisted software development, where coding LLMs are likely to contribute new dependency patterns not captured by traditional Software Composition Analysis tools.