CHAINS research project at KTH Royal Institute of Technology

Lockfiles for Maven. Pin your dependencies. Build with integrity.

Checksums for GitHub Actions.

Long term storage of software bills of materials (sbom) https://arxiv.org/pdf/2303.11102.pdf

calls the police if a prohibited class is loaded by the JVM http://arxiv.org/pdf/2407.00246

Force AI agents to use the latest version of dependency

Java-Class-Hijack: Software Supply Chain Attack for Java based on Maven Dependency Resolution and Java Classloading

empirical study of AI coding-agent commits (master thesis Xianqing)

Runtime enforcement of software supply chain capabilities in Go