Open Source Supply Chain

Definitions

1. The web of dependencies, maintainers, build systems, registries, and release processes through which open source software moves from author to downstream users. It is a major focus area in software security because compromise can propagate widely.

   In plain English: The chain of people, tools, and packages through which open source software reaches users.

   Example: "The audit focused on the open source supply chain, not just the app code, because transitive dependencies were the bigger risk."

Related Terms

• SBOM
• Third-Party Library
• Vendoring
• DependencyTrack
• Fork Bomb
• Open Source Security
• Package Ecosystem
• Package Security
• Reverse Dependency
• Transitive Dependency
• Zero-Day Patch
• Outdated Dependency