Software Supply Chain Failures
Breakdowns or malicious changes in the process of building, distributing, or updating software.
What it is
Software Supply Chain Failures is the renamed and significantly expanded successor to A06:2021 Vulnerable and Outdated Components. It moves up to #3 and broadens scope beyond just known-vulnerable dependencies to include all supply chain compromises: malicious packages, build-system attacks, IDE-extension compromises, and unmaintained components. Top-ranked in the 2025 community survey with 50% of respondents placing it #1. OWASP's relevant CWEs include CWE-477 (Obsolete Function), CWE-1104 (Unmaintained Third-Party Components), CWE-1329 (Reliance on Component That is Not Updateable), and CWE-1395 (Dependency on Vulnerable Third-Party Component).
Common patterns
- •Direct or transitive dependencies on packages with published CVEs and available patches.
- •Versions pinned to ranges (^1.2.3) that pull in compromised versions when an upstream account is hijacked.
- •Typosquatting: installing 'reactt' (typo) instead of 'react' and getting an attacker-controlled package.
- •Out-of-date container base images that ship known-vulnerable system libraries.
- •Use of packages whose maintainers have abandoned them, leaving published vulnerabilities unpatched.
- •Build systems (CI/CD, package registries, IDE extensions) compromised upstream of your code.
- •Components installed without integrity hashes or signature verification.
What Deva detects
Deva's SCA layer maintains a 27,000+ CVE advisory catalog synced from NVD, GHSA, and OSV, cross-referenced against a 2,800+ package metadata catalog. Scans match every direct and transitive dependency against the catalog, surfacing CVE ID, severity, fix version, and reachability indicators. Container scans use the same CVE catalog applied to base image system packages. The dsc CLI runs SCA as a CI step alongside SAST. Package metadata flags (low maintainer count, abandoned status, suspicious version ranges) are reported as advisories.
Real-world examples
| Year | Incident | What happened |
|---|---|---|
| 2017 | Equifax (Apache Struts CVE-2017-5638) | Apache Struts had a published CVE with patches available for 60+ days when Equifax was breached through the same vulnerability. The disclosure stage was textbook supply chain: a known vulnerable component that was not updated. |
| 2021 | Log4Shell (CVE-2021-44228) | A remote code execution vulnerability in the ubiquitous Log4j logging library affected tens of thousands of organizations. The transitive nature of the dependency made it difficult to find: organizations did not always know they were using Log4j until they scanned for it. |
| 2024 | XZ Utils backdoor (CVE-2024-3094) | A multi-year social engineering campaign placed a backdoor in the upstream xz-utils compression library. The backdoor targeted SSH authentication on Linux systems. The supply-chain attack was caught by an unrelated performance regression before mass exploitation. |
| 2020 | SolarWinds Orion (multiple victims) | Attackers gained access to SolarWinds' build pipeline and injected malicious code into Orion update packages signed with SolarWinds' legitimate signing key. Thousands of organizations including US federal agencies installed the trojaned updates. The canonical build-system supply chain attack. |
Compliance framework impact
- •NIST 800-53 RA-5 Vulnerability Monitoring, SI-2 Flaw Remediation, SR Supply Chain Risk Management
- •PCI-DSS v4.0 Req 6.3 Custom and third-party software vulnerabilities
- •HIPAA 164.308(a)(8) Evaluation
- •CMMC 2.0 RA.L2-3.11.2 Vulnerability scan, SI.L2-3.14.1 Flaw remediation
- •EO 14028 SBOM requirements for federal software
Deva detects the software supply chain failures patterns above at write time, alongside 970+ other CWE rules, with fixes mapped to the compliance controls each finding touches.