Dependency hell in software supply chains¶
Ask a technology department what its software is built on, and odds are it will gesture at the codebase and announce a magnificent digital edifice. Look under the floorboards and the edifice turns out to be teetering on assorted crates, barrels and borrowed planks acquired from a thousand strangers, rather like a warehouse in Ankh-Morpork held together by hope, rust, and a prayer to any god that has not yet resigned in exasperation.
Europe runs on oceans of open source. This is excellent. It is also a sort of ongoing civic hazard, because every unmaintained module is interest accruing quietly, growing in the dark like mould in a Morporkian cellar.
The clerk’s brief¶
From the clerks, for the Patrician’s eyes
Compiled September 2026. Entries run newest first; the settled patterns sink into the foundations at the end. The clerks wish to note that everything in this file was, at some point, somebody’s convenient shortcut.
September 2026: The agency names the packages¶
The ENISA Threat Landscape 2026, published 22 September 2026, singles out the increase in compromises of popular libraries and npm packages, as seen with the Shai-Hulud campaign, and points to the advisory on the secure use of package managers that ENISA published in March 2026. The clerks note that installing a package now comes with guidance from an EU agency.
September 2026: The law reaches the graph¶
Under the Cyber Resilience Act, since 11 September 2026 manufacturers have been required to report actively exploited vulnerabilities in products with digital elements, with the main obligations, including a software bill of materials covering at least the top-level dependencies, following from December 2027. An EU law now makes the contents of the crates and barrels someone’s accountable responsibility. Whether accountability can be retrofitted onto a volunteer bedrock is, the clerks concede, an open experiment.
March 2026: The keys, not the lock¶
On 31 March 2026 two backdoored releases of axios appeared on npm, a package the ecosystem fetches on the order of a hundred million times a week. The project’s own post-mortem records a targeted social engineering campaign and a remote access trojan on the lead maintainer’s machine, after which the releases went up from the command line.
Both carried a dependency called plain-crypto-js, which no line of axios imports and whose entire career consisted of a postinstall script dropping a trojan on macOS, Windows and Linux. It lived about three hours. The clerks note that a bill of materials listing top-level dependencies would have named axios, accurately, and said nothing whatever about the lodger it arrived with.
February 2026: The vulnerabilities doubled, with mechanical assistance¶
Black Duck’s analysis of 947 codebases, published February 2026, found the mean number of vulnerabilities per codebase jumped 107 per cent in a single year, a rise the report links to AI-assisted development. 65 per cent of surveyed organisations reported a supply chain attack in the previous year. The clerks observe that the industry has automated the acquisition of dependencies rather more thoroughly than the understanding of them.
January 2026: Sonatype keeps count¶
Sonatype’s state of the software supply chain report, published January 2026, counts 454,648 new malicious open source packages discovered in the past year, bringing the total tracked since 2019 to 1.23 million, while annual downloads across the four largest registries reached 9.8 trillion. Vulnerable versions of Log4j, patched since December 2021, were still downloaded 42 million times in 2025. The clerks note that a fix which nobody applies is indistinguishable, at a distance, from no fix at all.
The state of the foundations¶
The standing exhibits remain Heartbleed, disclosed April 2014, and Log4Shell, disclosed December 2021: both in ubiquitous volunteer-maintained components. The economic model of much of open source has not changed since; consumption is free and maintenance is donated. What has changed, since 2024 and 2025, is the institutional response: the CRA in force since December 2024 and ENISA’s European Vulnerability Database live since May 2025. Europe has begun regulating and cataloguing the problem. The clerks observe that none of these databases, reporting duties or inventories has yet invented a maintainer.