Open-Source Software (OSS) Supply Chain Threats and the Outlook for 2025

OSS as an attack vector

Open-source software (OSS) has become a significant threat vector over the past decade because of its widespread use and the absence of a shared accountability model. With over 5 million OSS packages available, around 90% of modern code uses them, and they account for up to 80% of the codebase in many companies. However, a lack of governance and transparency makes the ecosystem an ideal target for supply chain attacks.

Supply chain attacks have increased by 431% since 2021 and will continue to pose a high risk in 2025. As cybercrime is a business driven by the return on effort, compromising a single OSS package can lead to multiple breaches, affecting many businesses at once.

Threats specific to the OSS supply chain

1. Lack of SBOMs (Software Bill of Materials): OSS developers are not required to provide an SBOM, reducing visibility into software dependencies and increasing the risk of vulnerabilities.
2. Inconsistent update management: many OSS libraries are maintained with limited resources, resulting in irregular security updates.
3. Social and technical attacks: cases such as XZ Utils show how malicious actors can infiltrate OSS projects through social engineering.
4. Interference by foreign entities: hostile organisations and states exploit the OSS ecosystem to introduce malicious code (for example, the Polyfill incident).
5. Risk of critical vulnerabilities: incidents involving Log4j, Heartbleed and Shellshock highlight the unpredictability and potential impact of widespread vulnerabilities.

AI and OSS: new security challenges

Artificial intelligence (AI) is expected to be a major disruptive factor in cybersecurity in 2025. The growing use of AI-powered code generation tools, such as ChatGPT, exposes businesses to new risks:

• "AI package hallucination": malicious actors can prompt AI models to suggest non-existent packages and then publish compromised versions to OSS registries such as npm or PyPI.
• AI-introduced vulnerabilities: AI-based code synthesis can inadvertently introduce security flaws.
• Open-source AI models: downloadable open-source AI models on platforms such as Hugging Face present risks similar to traditional OSS libraries.

Efforts to defend the OSS supply chain

1. SBOMs: although promoted by the US government through Executive Order EO14028, adoption remains limited. Tools such as npm sbom . (a command that generates a Software Bill of Materials, or SBOM) simplify dependency management, but it remains to be seen whether businesses will use them widely.
2. AI BOMs: the industry is working to develop SBOMs specifically for AI models, such as ML-BOMs, to track datasets, algorithms and dependencies.
3. Tea Protocol: a new blockchain-based framework aims to improve OSS sustainability and security by rewarding developers and incentivising vulnerability reporting. However, there are concerns about abuse and denial-of-service (DoS) attacks targeting OSS registries.

Regulation and the future of OSS security

2025 will see increased regulation of software supply chain security, with measures such as NIS2, DORA and ECRA in Europe and US initiatives such as CISA Secure by Design. However, reactive regulation could increase costs and drive companies to reduce support for purely open-source software in favour of closed-source or hybrid-licence alternatives.

Conclusion

OSS will continue to pose a software supply chain risk in 2025. While SBOMs, regulations and new technologies offer defensive tools, no solution guarantees complete security. Businesses must prepare for an evolving threat landscape by strengthening OSS governance and adopting proactive mitigation strategies.

Source: SecurityWeek.com