The software supply chain still rests on people who are not paid to answer the phone.

The technical response to software supply chain attacks has been genuinely good. Signed artefacts, build provenance, software bills of materials and automated dependency scanning are all more widely deployed than they were three years ago.

The social structure underneath has barely moved. A large share of widely used packages are maintained by one or two people, unpaid, alongside full time employment.

Why that is the vulnerability

Every documented takeover of a popular package followed the same human pattern. A tired maintainer, a helpful stranger who contributed useful work for months, and eventually commit access granted out of relief rather than diligence.

No signing scheme prevents that, because the malicious commit is signed correctly by a legitimate maintainer.

What actually reduces it

Funding maintainers directly, which a small number of large companies now do at meaningful scale. Requiring two-person review on the specific packages an organisation depends on most. And knowing which those packages are, which most organisations still cannot say precisely.

A concrete step

Rank your dependencies by how badly a compromise would hurt, not by how many there are. Then look at the top twenty and count the maintainers. The answer is usually uncomfortable and usually actionable.