Blog - You don't have a supply chain, you have supply soup | Open Source Security

2026 has been a wild year. There are more vulnerabilities than anyone can count. We seem to keep talking about the number itself instead of things like how we got here or what we’re going to do about it, which is neat. The number of attacks against open source is basically an uncountable mess. Also very neat. And the cherry on top of this poop sundae is number of companies that have promised us they are going to “fix” open source, and when they use the word fix they really mean sell you a solution for a problem they mostly made up. Very cool, very cool.

All this mixed together makes one wonder about this mythical supply chain thing that was all the rage in 2025. Remember 2025? Me neither. It was like 7 years ago, which was a long time ago.

But anyway, this supply chain thing. We used to talk about what it meant, mostly how you had to be careful with open source which was a bunch of untrustworthy cartoon villains apparently spending their free time creating software and giving it away. For free. How Dare They!

Also, keep in mind that open source can only be secured by startups and sometimes the Linux Foundation. It all sounded very cool. Since doing nothing is always easier than doing something, nothing won and everyone kept using open source. This was to the chagrin of the startups and the Linux Foundation.

So now that we’re in 2026, apparently open source is less trustworthy than ever. There are tons of vulnerabilities being found by our robot overlords. We’re starting to hear about these new vulnerability clearinghouses that will collect vulnerabilities in the open source but nobody is really sure what will happen inside this Monty Python Architect Sketch. Maybe it’s like a bug bounty but with more knives or something?

There are an absolute insane number of malicious packages in the open source registries (which also don’t have enough resources). The registries seem to be working on this using only small bits of string and empty cans, which is unfortunately how open source solves problems.

It’s impossible to even start to keep track of all this. The thing 2026 seems to be teaching us is we don’t have a supply chain, we have a supply soup.

What is Supply Soup?#

The idea of a supply chain seems to make sense if you think about it. There is a path software will traverse before it gets to you. You can know for certain if the software you are running is responsible for explosive diarrhea just by looking at the links in your chain. If your first thought was software can’t cause explosive diarrhea you have never tried to debug C++.

But it’s not really a chain is it. It’s a soup. All the software we use, open source or not, isn’t some nice collection of links we can follow back to a source. It’s a soup filled with ingredients we don’t really understand and sometimes don’t want to understand.

It’s worth going deeper into some of this in the future. But for now let’s take a very high level think about what it takes to get one open source dependency to your project. The developer has a computer, with an operating system. Where did that operating system come from? It’s a collection of packages. Yes even Windows and OSX are basically collections of packages. How many other developers are part of those packages, all with operating systems, and internet providers, and build systems, and package dependencies. All of those dependencies have the same collection of things behind them. It’s an absolute vat of hardware and software we can’t reasonably understand if we wanted to.

We don’t really know how to draw the boundaries on any of this. There are many attempts. We tend to ignore developer workstations, and CI runners. Or GitHub project members. The current obsession is with individual bits of software. It’s likely a lot of those are built inside infrastructure we have zero actual information about. But we don’t talk about a lot of this very often, probably because it’s inconvenient. Doing nothing wins again.

Those vegetables might be organic, but if the broth you’re cooking them in is from a storm sewer, nobody cares if the vegetables are organic or not.

This post is weird, what’s the point#

There’s two reasons I wrote this. Well, three really. First, I may never have an opportunity to use the term “explosive diarrhea” again in a blog post.

Second is this is something I want to start to think about and make a thing we start to understand. We are getting better at caring about some of this and figuring it out, but that’s just the beginning. There are a lot of other things we need to understand in this space. This is one of those instances where when we solve one problem we find out there were 3 new problems hiding behind the first.

And...