How do software supply chain risks actually manifest in modern CI CD pipelines and what is the best way to detect malicious dependencies early
Download run
Fan-out diagram
The searches the AI actually ran for this prompt.
SEED QUERY
How do software supply chain risks actually manifest in modern CI CD pipelines and what is the best way to detect malicious dependencies early
2 real searches · 1 real-search pass
OpenSSF Scorecard dependency security checks pinned dependencies dangerous workflows official documentation SLSA provenance SBOM vulnerability scanning CI/CD malicious packagesGoogle ↗
OBSERVED
CISA software supply chain security guidance SBOM secure build pipeline dependency management officialGoogle ↗
OBSERVED
Badge and edge weight = share of passes that produced the query. Hover a query for its intent and routing format.
Query classes
Google's semantic query class for every sub-query: what kind of answer each search is after, simulated vs real.
Classifying 2 queries…
Searches and sources
ChatGPT2 real searches · gpt-6
OpenSSF Scorecard dependency security checks pinned dependencies dangerous workflows official documentation SLSA provenance SBOM vulnerability scanning CI/CD malicious packages Google ↗
CISA software supply chain security guidance SBOM secure build pipeline dependency management official Google ↗
- Securing the Software Supply Chain: · cisa.gov
- Securing the Software Supply Chain: · cisa.gov
- Software supply chain attacks: check your dependencies · ncsc.gov.uk
- OSV-Scanner · google.github.io
- OpenSSF Scorecard · scorecard.dev
- Syft · github.com
- Trivy · trivy.dev
- Dependency-Track · dependencytrack.org
- SLSA framework · slsa.dev
- SP 800-204D, Strategies for the Integration of Software Supply Chain Security in DevSecOps CI/CD Pipelines · csrc.nist.gov
- Software Security in Supply Chains: Open Source Software Controls · nist.gov
Queries
2 queries · click a column to sort
| Query / type | Search | Intent | Query class | Routing format | Cluster | Freq ↓ | Weight |
|---|---|---|---|---|---|---|---|
OpenSSF Scorecard dependency security checks pinned dependencies dangerous workflows official documentation SLSA provenance SBOM vulnerability scanning CI/CD malicious packages OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 | |
CISA software supply chain security guidance SBOM secure build pipeline dependency management official OBSERVED | Google ↗ AI Mode ↗ | — | — | — | — | 1x of 1 |