We Solved Supply Chain Security Once. Then We Got Impatient.

Why did we stop checking what we install?

I keep hearing that supply chain security is one of the hardest problems in our field. I've never really agreed. When I started out, we handled it more or less fine, and the way we did it wasn't clever. We just did it slowly.

If a project needed a library, someone downloaded it, looked at it, and put it on an internal server. Builds ran against that copy. You knew what you had, because you had put it there yourself. If the upstream project disappeared or got hijacked, you found out from the news and not from a broken production system. It was tedious, and developers complained about it, but it worked.

Somewhere along the way we stopped. Today a normal build pulls hundreds of packages straight from public registries. Half of them are dependencies of dependencies that nobody on the team has ever heard of. Version ranges are open, container images come from latest, and CI actions point to tags that the author can move whenever they like. Nobody decided this was a good idea. It happened because it was faster, and everyone was measured on speed.

Attackers noticed, of course. SolarWinds, the xz backdoor and the constant stream of malicious npm and PyPI packages all rely on the same habit: we trust what arrives because checking it takes time.

AI has made this worse, and I think it's the part we talk about least. A coding assistant will happily suggest a package nobody on the team has looked at. Sometimes it suggests one that doesn't exist, and then an attacker registers that name and waits. Agents now install tools, download models and connect to outside servers, and each of those is a supply chain decision. More and more of them are made by no human at all.

We went from "we download it and inspect it" to "the model suggested it and the pipeline installed it."

What bothers me is that the fixes are not new. Keep an internal mirror and build from it. Pin your versions and verify hashes and signatures. Don't adopt a release the day it comes out, because most malicious packages are caught within a few days. Keep an SBOM so you can answer "are we affected?" in minutes and not days. And treat anything an AI suggests the same way you'd treat a package from a stranger, because that is what it is.

None of this needs a new product or a new budget line. It needs someone to accept that it costs a bit of speed, and that is where it usually falls apart. Security ends up being the team that says "wait", and that is not a fun role to play when the roadmap is full.

I don't think we forgot how to do this. We just got used to not doing it.