Software supply chain attacks are on the rise, increasing a staggering 742% per year on average since 2019. Sometimes called “third party attacks,” these cyberattacks infiltrate third party or open source software libraries with malicious code, infecting vendors and components along the software supply chain. These days, any given software artifact may depend on hundreds or even thousands of third party or open source libraries (often comprising up to 85% of their total code base), each of which is trusted to properly implement its expected functionality. When a supply chain attack compromises and inserts malicious functionality into any of those libraries, the final software artifact is compromised as well. To make matters worse, the same library may be used by multiple software artifacts, so a successful supply chain attack against one library could adversely impact all the software artifacts that depend on it. Back in 2020, a particularly infamous attack struck American software company SolarWinds. Hackers compromised the machines that signed and distributed updates for SolarWinds’ network and traffic monitoring product, known as Orion, modifying the software to grant them illicit access to the machines running the modified Orion code. With malicious code lurking unseen in the shadows, tens of thousands of customers—including Fortune 500 companies and government agencies—were impacted after downloading what should have been a routine software update. In another example, in early 2022 the developer of node-ipc, a popular Javascript library, modified the code to delete random files for us