Modern software systems heavily rely on third-party dependencies, making software supply chain security a critical concern. We introduce the concept of software supply chain smells as structural indicators that signal potential security risks. We design and evaluate Dirty-Waters, a novel tool for detecting such smells in the supply chains of software packages. Through interviews with practitioners, we show that our proposed smells align with real-world concerns and capture signals considered valuable. A quantitative study of popular packages in the Maven and NPM ecosystems reveals that while smells are prevalent in both, they differ significantly across ecosystems, with traceability and signing issues dominating in Maven and most smells being rare in NPM, due to strong registry-level guarantees. Software supply chain smells support developers and organizations in making informed decisions and improving their software supply chain security posture.

翻译：现代软件系统高度依赖第三方组件，使得软件供应链安全成为关键问题。我们提出"软件供应链异味"概念，将其作为表征潜在安全风险的结构性指标。我们设计并评估了 Dirty-Waters 这一用于检测软件包供应链中此类异味的新型工具。通过从业者访谈，我们证明了所提出的异味与真实场景中的问题相契合，且能捕获被认为有价值的信号。对 Maven 和 NPM 生态系统中流行软件包的定量研究揭示：虽然异味在两个生态系统中普遍存在，但其分布存在显著差异——Maven 中以可追溯性和签名问题为主，而 NPM 中多数异味较为罕见（得益于其注册表层面的强保障）。软件供应链异味可支持开发者和组织做出明智决策，并改善其软件供应链安全态势。