Software supply chain security
Software supply-chain protection is changing in how code gets released as well as through regulation. npm now supports multiple trusted-publishing configurations and requires malware scanning before staged approval. Separately, the reporting requirements of the EU Cyber Resilience Act apply from September 2026 and its main obligations from December 2027. Neither creates one worldwide source of demand, and a signed package can still be unsafe.
Research snapshot · updated Nov 12, 2026
Core thesis
Modern software depends on hundreds of open-source packages, and each one is a possible route for an attack. The xz-utils backdoor in 2024 showed that one compromised maintainer can put millions of systems at risk. The Shai-Hulud worms in 2025 spread through npm using stolen maintainer credentials. In the US, OMB memorandum M-26-05 of 23 January 2026 replaced the earlier federal rules on secure software development with a risk-based approach. Agencies may still use the software development attestation form. In the EU, the Cyber Resilience Act's reporting duties apply from September 2026 and its main obligations from December 2027. Much open-source software is maintained by volunteers and relied on by large companies.
State of the art (2026)
Software supply chain security has shifted from compliance theatre to active incident response. The Shai-Hulud npm worm – first detected September 2025, then Shai-Hulud 2.0 backdooring 796 packages that November, and a cross-registry Mini Shai-Hulud hitting npm and PyPI in May 2026 – proved self-replicating package attacks now scale autonomously through stolen maintainer tokens. The US has retreated to a risk-based, agency-led posture after OMB rescinded the M-22-18 SBOM attestation mandate in January 2026; the regulatory centre of gravity has moved to the EU Cyber Resilience Act, whose reporting duties bite from 11 September 2026 and full SBOM obligations from December 2027. Chainguard (3.5bn valuation), Snyk, Socket and Endor Labs lead the commercial response.
Explore the deeper analysis in CanaryIQ
Explore what is covered below. These previews show the structure; log in to read the full analysis.
Signal stack
Evidence stacked leading → lagging
9 signals
Signal stack
Evidence stacked leading → lagging
Technology-native KPIs
Metrics that predict trajectory, tracked over time
4 tracked
Technology-native KPIs
Metrics that predict trajectory, tracked over time
Landscape map
Who builds what, and who depends on whom
99 players · 6 layers
Landscape map
Who builds what, and who depends on whom
Catalyst calendar
Dated events that will move the position
4 ahead
Catalyst calendar
Dated events that will move the position
Technology roadmap
Milestones on the path to maturity
8 milestones
Technology roadmap
Milestones on the path to maturity
Watchlists
Companies, people and papers, each with a condition for removing it
20 · 20
Watchlists
Companies, people and papers, each with a condition for removing it
Decision frameworks
What our view means for your job
Locked
Decision frameworks
What our view means for your job
Thesis changelog
When our view changed, and why
8 updates
Thesis changelog
When our view changed, and why
Change our mind
2 disconfirming conditions
You've read the verdict. The file is much deeper.
The full signal stack, technology-native KPIs tracked over time, the landscape of who depends on whom, the dated catalyst calendar, decision frameworks for every desk, live watchlists and a record of every time our view on Software supply chain security has changed. All of it is in CanaryIQ.