Get started
Work

Securing the open-source ecosystem: AI-enhanced and explainable supply chain security for reliable software development

Year: 2026
Type: article
Abstract: Modern software supply chains face increasing risks from vulnerable and anomalous dependencies, necessitating automated and interpretable detection methods integrated within Continuous Integration and Continuous Deployment (CI/CD) workflows. Open-source software (OSS) ecosystems are increasingly targeted by sophisticated attacks—including AI model poisoning, dependency confusion, contributor hijacking, and transitive dependency anomalies—that often evade traditional CVE-centric tools such as Snyk and Dependabot. These reactive solutions are primarily designed for known vulnerabilities and may exhibit high false-positive rates when applied to behavioral anomalies, while also lacking interpretable and actionable guidance for developers. This limitation creates a critical barrier to reliable and secure software development in modern DevSecOps environments. To address this gap, this paper introduces XAI-SCS, an intelligent, explainable decision-support framework for OSS supply chain security that performs metadata-driven behavioral risk assessment to proactively identify anomalous package activity. A hybrid CNN–LSTM–Autoencoder architecture achieves strong anomaly-detection performance on the held-out test set (F1 = 0.91), with low repeated-run variability (mean F1 = 0.90 ± 0.02 across five runs) on a federated dataset of 12,000 npm/PyPI package versions, primarily trained using CVE-linked labels and GAN-simulated poisoning samples. A separate held-out evaluation set of 240 manually curated real-world non-CVE OSS supply-chain incidents was used exclusively for external generalization assessment. Accordingly, the non-CVE results are interpreted as preliminary evidence of transferability to selected metadata-visible behavioral anomalies rather than comprehensive real-world non-CVE threat coverage. To support transparent developer decision-making, SHAP-based explanations and counterfactual remediation suggestions produced high perceived clarity (4.3 ± 0.4/5) and actionability (4.1 ± 0.5/5) and self-reported remediation intent (96%, n = 82). However, these findings reflect developer perceptions in a controlled study and do not yet demonstrate measured improvements in real-world remediation time, fix completion, or vulnerability resolution within operational DevSecOps teams. Optional high-assurance deployment extensions, including Federated Continual Learning, zero-knowledge attestation via zk-SNARKs, and post-quantum secure enclaves, are presented as exploratory architectural pathways for future privacy-preserving, verifiable, and confidential deployment, rather than as part of the core empirical evaluation. Embedded in controlled, CI/CD-representative workflows with 0.8-second average latency, XAI-SCS remains competitive with CVE-centric tools on known-vulnerability cases while providing preliminary evidence of complementary metadata-level behavioral risk screening in GAN-simulated and limited curated non-CVE evaluation subsets. The comparison is therefore interpreted as evidence that XAI-SCS can complement CVE-centric SCA tools by adding metadata-level behavioral screening and developer-facing explanations, rather than replacing or universally outperforming tools such as Snyk and Dependabot. This work’s primary contribution is a metadata-driven, CI/CD-integrated intelligent decision-support framework that delivers high-accuracy behavioral anomaly detection (F1 = 0.91) and transparent, developer-facing explanations (clarity 4.3/5, remediation intent 96%) for OSS supply chain risk assessment. Optional high-assurance deployment extensions (federated learning, cryptographic attestation, secure enclaves) are discussed separately and do not form part of the core empirical evaluation.
DOI: 10.1038/s41598-026-69729-3
Language: English
Open Access status: gold
Estimated APC paid: $2,690
OpenAlex ID: W7204164787
FWCI:
Cites:
Cited by:
Related to: