# SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties

arXiv: https://arxiv.org/abs/2406.10109 · HTML: https://mlsanity.com/paper/2406.10109/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 14 Jun 2024.

## Built on by (most cited first, 6 of 6)

- [How Your Credentials Are Leaked by LLM Agent Skills: An Empirical Study](https://mlsanity.com/paper/2604.03070/) (2026)
- [An Empirical Analysis of Machine Learning Model and Dataset Documentation, Supply Chain, and Licensing Challenges on Hugging Face](https://mlsanity.com/paper/2502.04484/) (2025)
- [Security Considerations for Multi-agent Systems](https://mlsanity.com/paper/2603.09002/) (2026)
- [Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigation](https://mlsanity.com/paper/2512.23480/) (2025)
- [Leveraging Code Cohesion Analysis to Identify Source Code Supply Chain Attacks](https://mlsanity.com/paper/2510.14778/) (2025)
- [Resource-Optimized and Energy-Aware Agentic AI Framework Anchored on Blockchain for Secure Software Supply Chains](https://mlsanity.com/paper/2609.31282/) (2026)

## Abstract (arXiv)

This paper systematizes knowledge about secure software supply chain patterns. It identifies four stages of a software supply chain attack and proposes three security properties crucial for a secured supply chain: transparency, validity, and separation. The paper describes current security approaches and maps them to the proposed security properties, including research ideas and case studies of supply chains in practice. It discusses the strengths and weaknesses of current approaches relative to known attacks and details the various security frameworks put out to ensure the security of the software supply chain. Finally, the paper highlights potential gaps in actor and operation-centered supply chain security techniques