BLOCKCHAIN-ENABLED SECURE SOFTWARE SUPPLY CHAIN MANAGEMENT IN OPEN-SOURCE DEVELOPMENT ECOSYSTEMS

Abstract

While open-source software ecosystems have become the backbone of modern application development, their increasing popularity and reliance have consequently also paved the way for an increase in vulnerabilities in the supply chain, especially package injection, untrustworthy commits and compromised dependencies. This research compares the structural risk factors in Open-Source repositories and the effectiveness of the mitigating controls of signed commit rates and blockchain-enabled verification. This research had 100 repositories in major programming languages, Python, JavaScript, Go, Ruby, Java and C++ – and used descriptive statistics, Pearson correlation analysis and Ordinary Least Squares multiple linear regression to use empirical data. The regression model proved to have a very high explanatory power since the R²=0.973 means that the variance of risk scores is explained by the model 97.3%. The results show that the standardized coefficient for outdated dependencies is 0.202 and for vulnerability counts 0.383, emphasizing that these are all important factors for a higher risk score. On the other hand, a positive standardized signed commit rates shows significant risk-mitigating effect with an unstandardized coefficient of -4.674. Although the direction of the effect of the blockchain verification variable was negative, it was not statistically significant in this dataset, indicating that the implementation of blockchain has the best effect when combined with proper code-signing. The findings offer both practical recommendations and guidelines for software engineering groups and open-source maintainers looking to improve supply chain security by using evidence-driven interventions.