Document Open Access Logo

Software Supply Chains Are Dead: Use-Case-Oriented Regeneration

Authors Tanmay Singla , James C. Davis

PDF

File

Thumbnail PDF
PDF
LIPIcs.ESEM.2026.64.pdf
  • Filesize: 3.35 MB
  • 14 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Software and its engineering → Software libraries and repositories
  • Software and its engineering → Software verification and validation
  • Computing methodologies → Artificial intelligence
Keywords
  • Software supply chain
  • dependency reuse
  • code generation
  • AI coding agents

Metrics

Abstract

Modern software development relies on an increasingly doubtful premise: that the up-front implementation savings from adopting a dependency outweighs the maintenance costs. Two changes are reshaping the build-vs.-reuse calculus: software supply chain attacks have raised the cost of external reliance, while generative AI has lowered the cost of local implementation. In this vision paper, we discuss use-case-oriented regeneration as a new software sourcing paradigm that shifts the supply chain from external trust to local verification. We evaluate an agentic workflow that synthesizes only the specific slice of dependency functionality that a repository exercises. Our measurements across 180 repository-dependency pairs suggest that this approach is feasible: the replacements preserve 99.8% of repository-observed behavior across baseline validation checks and reduce the exported API surface by 93%. Software sourcing may evolve toward verifiable repository-specific code synthesis, especially when the required functionality is narrow, stable, and well tested.

Cite As Get BibTex

Tanmay Singla and James C. Davis. Software Supply Chains Are Dead: Use-Case-Oriented Regeneration. In 20th International Symposium on Empirical Software Engineering and Measurement (ESEM 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 394, pp. 64:1-64:14, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ESEM.2026.64

Author Details

Tanmay Singla
  • Purdue University, West Lafayette, IN, USA
James C. Davis
  • Purdue University, West Lafayette, IN, USA

Funding

We acknowledge support from the US National Science Foundation under award #2541917.

Supplementary Materials

References

  1. Rabe Abdalkareem, Vinicius Oda, Suhaib Mujahid, and Emad Shihab. On the impact of using trivial packages: an empirical case study on npm and pypi. Empirical Software Engineering, 25:1168-1204, 2020. URL: https://doi.org/10.1007/S10664-019-09792-9.
  2. Paschal C. Amusuo, Kyle A. Robinson, Santiago Torres-Arias, Laurent Simon, and James C. Davis. Ztd_java: Mitigating software supply chain vulnerabilities via zero-trust dependencies. In International Conference on Software Engineering (ICSE), 2025. Google Scholar
  3. Barry W. Boehm. Software engineering economics. IEEE transactions on Software Engineering, 10(1):4-21, 1984. URL: https://doi.org/10.1109/TSE.1984.5010193.
  4. James C. Davis. Model-based agentic software engineering. https://davisjam.github.io/model-based-agentic-software-engineering/book/mage-book.pdf, 2026. Online book. Accessed: 2026-08-05.
  5. James C Davis, Paschal C Amusuo, Tanmay Singla, Berk Çakar, and Kirsten A Davis. Cheap code, costly judgment: A case study on governable agentic software engineering. [arXiv'26] arXiv preprint, 2026. URL: https://arxiv.org/abs/26].
  6. Sivana Hamer, Nasif Imtiaz, Mahzabin Tamanna, Preya Shabrina, and Laurie Williams. Trusting code in the wild: Exploring contributor reputation measures to review dependencies in the rust ecosystem. IEEE Transactions on Software Engineering, 2025. Google Scholar
  7. Ruiyin He, Tomi Saarinen, Nyyti Saarinen, Arie van Deursen, and Mika Mäntylä. Automating dependency updates in practice: An exploratory study on security vulnerabilities and other dependency update issues. IEEE Transactions on Software Engineering, 2023. Google Scholar
  8. Fang Hou and Slinger Jansen. A systematic literature review on trust in the software ecosystem. Empirical Software Engineering, 28(1), 2023. URL: https://doi.org/10.1007/S10664-022-10238-Y.
  9. Abbas Javan Jafari, Diego Elias Costa, Emad Shihab, and Rabe Abdalkareem. Dependency update strategies and package characteristics, 2023. URL: https://doi.org/10.48550/arXiv.2305.15675.
  10. Dhanushka Jayasuriya, Samuel Ou, Saakshi Hegde, Valerio Terragni, Jens Dietrich, and Kelly Blincoe. An extended study of syntactic breaking changes in the wild. Empirical Software Engineering, 30(2), 2024. URL: https://doi.org/10.1007/S10664-024-10563-4.
  11. Carlos E. Jimenez, John Yang, Alexander Wettig, Shunyu Yao, Kexin Pei, Ofir Press, and Karthik Narasimhan. Swe-bench: Can language models resolve real-world github issues? arXiv preprint, 2023. URL: https://doi.org/10.48550/arXiv.2310.06770.
  12. Kelechi G. Kalu, Sofia Okorafor, Betül Durak, Kim Laine, Radames C. Moreno, Santiago Torres-Arias, and James C. Davis. Arms: A vision for actor reputation metric systems in the open-source software supply chain. In Journal Ahead Workshop (JAWs), 2026. Google Scholar
  13. Kelechi G. Kalu, Tanmay Singla, Chinenye Okafor, Santiago Torres-Arias, and James C. Davis. An industry interview study of software signing for supply chain security. In USENIX Security Symposium, pages 81-100, 2025. URL: https://www.usenix.org/conference/usenixsecurity25/presentation/kalu.
  14. Evangelos Lamprou, Julian Dai, Grigoris Ntousakis, Martin C. Rinard, and Nikos Vasilakis. Lexo: Eliminating stealthy supply-chain attacks via llm-assisted program regeneration, 2025. URL: https://doi.org/10.48550/arXiv.2510.14522.
  15. Enrique Larios Vargas, Maurício Aniche, Christoph Treude, Magiel Bruntink, and Georgios Gousios. Selecting third-party libraries: the practitioners’ perspective. In Foundations of Software Engineering (ESEC/FSE), 2020. Google Scholar
  16. Linux Foundation. A summary of census ii: Open source software application libraries the world depends on, 2022. URL: https://www.linuxfoundation.org/blog/blog/a-summary-of-census-ii-open-source-software-application-libraries-the-world-depends-on.
  17. Yuxin Liu, Deepika Tiwari, Cristian Bogdan, and Benoit Baudry. Detecting and removing bloated dependencies in commonjs packages. Journal of Systems and Software, 230:112509, 2025. URL: https://doi.org/10.1016/J.JSS.2025.112509.
  18. Ivano Malavolta, Kishan Nirghin, Gian Luca Scoccia, Simone Romano, Salvatore Lombardi, Giuseppe Scanniello, and Patricia Lago. Javascript dead code identification, elimination, and empirical assessment. IEEE Transactions on Software Engineering, 49(7):3692-3714, 2023. URL: https://doi.org/10.1109/TSE.2023.3267848.
  19. Mark Marron. Toward an agentic infused software ecosystem, 2026. URL: https://doi.org/10.48550/arXiv.2602.20979.
  20. Marc Ohm, Henrik Plate, Arnold Sykosch, and Michael Meier. Backstabber’s knife collection: A review of open source software supply chain attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), pages 23-43, 2020. URL: https://doi.org/10.1007/978-3-030-52683-2_2.
  21. Chinenye Okafor, Taylor R. Schorlemmer, Santiago Torres-Arias, and James C. Davis. Sok: Analysis of software supply chain security by establishing secure design properties. In Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED), pages 15-24, 2022. URL: https://doi.org/10.1145/3560835.3564556.
  22. Erik Pautsch, Tanmay Singla, Parv Kumar, Wenxin Jiang, Huiyun Peng, Behnaz Hassanshahi, Konstantin Läufer, George K. Thiruvathukal, and James C. Davis. AgentHub: A registry for discoverable, verifiable, and reproducible ai agents. In The Journal Ahead Workshop (JAWs 2026), co-located with the 48th International Conference on Software Engineering (ICSE 2026), April 2026. Google Scholar
  23. Hammond Pearce, Baleegh Ahmad, Benjamin Tan, Brendan Dolan-Gavitt, and Ramesh Karri. Asleep at the keyboard? assessing the security of github copilot’s code contributions, 2021. URL: https://arxiv.org/abs/2108.09293.
  24. pip developers. Vendoring policy. URL: https://pip.pypa.io/en/latest/development/vendoring-policy/.
  25. Serena Elisa Ponta, Wolfram Fischer, Henrik Plate, and Antonino Sabetta. The used, the bloated, and the vulnerable: Reducing the attack surface of an industrial application. In International Conference on Software Maintenance and Evolution (ICSME), pages 555-558, 2021. URL: https://doi.org/10.1109/ICSME52107.2021.00056.
  26. Anh Quach, Hoa Nguyen, Derek Bruening, Jason Hiser, Cristiano Giuffrida, Vasileios P. Kemerlis, Ramesh Peri, and Michael Payer. Debloating software through piece-wise compilation and loading. In USENIX Security Symposium, pages 341-356, 2018. Google Scholar
  27. Eric Raymond. The cathedral and the bazaar. Knowledge, Technology & Policy, 12(3):23-49, 1999. Google Scholar
  28. Tanmay Singla, Berk Çakar, Paschal C. Amusuo, and James C. Davis. Towards a benchmark for dependency decision-making, 2026. URL: https://doi.org/10.48550/arXiv.2601.00205.
  29. Tanmay Singla and James C. Davis. Software supply chains are dead: Use-case-oriented regeneration, May 2026. URL: https://doi.org/10.5281/zenodo.20370439.
  30. SLSA Contributors. Supply-chain levels for software artifacts (slsa) provenance specification, 2023. URL: https://slsa.dev/spec/v1.0/provenance.
  31. Socket. Socket security: Proactive open source supply chain protection. https://socket.dev/, 2026.
  32. Sonatype. 2026 state of the software supply chain report, 2026. URL: https://www.sonatype.com/state-of-the-software-supply-chain.
  33. Synopsys Cybersecurity Research Center. Open source security and risk analysis (OSSRA) report. Technical report, Synopsys, Inc., 2024. Google Scholar
  34. Tamanna, Greg Tystahl, Nusrat Zahan, Patrick Morrison, Yasemin Acar, Michel Cukier, Christian Kästner, Alexandros Kapravelos, Dominik Wermke, and William Enck. Research directions in software supply chain security. ACM Transactions on Software Engineering and Methodology, 34(5), 2025. URL: https://doi.org/10.1145/3714464.
  35. Nikos Vasilakis, Achilles Benetopoulos, Shivam Handa, Alizee Schoen, Jiasi Shen, and Martin C. Rinard. Supply-chain vulnerability elimination via active learning and regeneration. In Conference on Computer and Communications Security (CCS), pages 1755-1770, 2021. URL: https://doi.org/10.1145/3460120.3484736.
  36. Qian Wang et al. OpenHands: An open platform for ai software developers as generalist agents, 2024. URL: https://github.com/OpenHands/OpenHands.
  37. webpack. Tree shaking, 2025. URL: https://webpack.js.org/guides/tree-shaking/.
  38. N. R. Weeraddana, Mahmoud Alfadel, and Shane McIntosh. Dependency-induced waste in continuous integration: An empirical study of unused dependencies in the npm ecosystem. ACM Transactions on Software Engineering and Methodology, 2024. Google Scholar
  39. Erik Wittern, Philippe Suter, and Shriram Rajagopalan. A look at the dynamics of the javascript package ecosystem. In Mining Software Repositories (MSR), pages 351-361, 2016. URL: https://doi.org/10.1145/2901739.2901743.
  40. John Yang, Yu Zhang, Zihang Chen, et al. Swe-agent: Agent-computer interfaces enable automated software engineering. In Advances in Neural Information Processing Systems (NeurIPS), 2024. Google Scholar
  41. Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. Small world with high risks: A study of security threats in the npm ecosystem. In USENIX Security Symposium, pages 995-1010, 2019. URL: https://www.usenix.org/conference/usenixsecurity19/presentation/zimmerman.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact