Notifications
Clear all
Topic starter
20/08/2026 5:24 pm
TL;DR: OWASP’s 2025 Top 10 ranked software supply chain failures #3 with 106 first-place votes, a consensus signal that the category has moved beyond patched dependencies to compromised build systems, poisoned pipelines, and client-side runtime risk, according to Jscrambler. The practical shift is clear: visibility must extend from CI/CD inventories into what actually executes in users’ browsers, where conventional appsec controls still leave major blind spots.
NHIMG editorial — based on content published by Jscrambler: OWASP’s 2025 Top 10 update and the expansion of software supply chain risk
By the numbers:
- OWASP’s 2025 Top 10 update gave Software Supply Chain Failures 106 first-place votes out of 212 respondents.
- 92% of webpages load third-party resources, which means most browser sessions execute code beyond the organisation’s direct control.
- 50% of JavaScript on e-commerce sites comes from third-party sources, widening the runtime attack surface beyond first-party code.
Questions worth separating out
Q: What breaks when software supply chain controls rely only on post-build scanning?
A: Post-build scanning often finds problems after risky code, secrets, or malicious dependencies have already entered repositories, images, or deployment pipelines.
Q: Why do third-party scripts create governance risk similar to non-human identities?
A: Third-party scripts execute inside a live session with inherited privileges, broad context, and little lifecycle oversight.
Q: How can security teams measure whether supply chain controls are actually working?
A: Look for reduced use of long-lived publishing tokens, fewer workflows with broad secrets access, lower dependency auto-update exposure, and faster revocation after compromise.
Practitioner guidance
- Inventory executed scripts, not just declared dependencies Maintain a continuously updated record of every first-party and third-party script that actually runs in production browsers, including tags loaded dynamically after page render.
- Add runtime behaviour controls to client-side governance Monitor what scripts do after load, including access to DOM elements, form fields, and network destinations.
- Map secrets and delegated access paths across the delivery chain Trace where API keys, tokens, and service credentials enter build systems, package registries, tag managers, and browser-delivered code.
What's in the full article
Jscrambler's full article covers the operational detail this post intentionally leaves for the source:
- Runtime script integrity controls for browser-executed third-party code
- How Webpage Integrity maps to payment-page monitoring and PCI DSS requirements
- First-party JavaScript protection with polymorphic obfuscation and anti-tampering
- The article's observations on data governance implications for user input and session signals
👉 Read Jscrambler’s analysis of OWASP’s software supply chain category shift →
Software supply chain failures now extend into the browser runtime?
Explore further
20/08/2026 6:14 pm
Software supply chain failures are now an identity-adjacent governance problem, not just an appsec category. The article makes clear that build integrity alone does not protect the software delivery chain once secrets, scripts, and delegated access are present at runtime. That matters because identity controls fail when trust is granted to components that can change outside normal review windows. Practitioners should treat software delivery as a governed trust chain, not a static dependency list.
A question worth separating out:
Q: Who should own risk when a trusted dependency or script is compromised?
A: Ownership should be shared across application security, platform engineering, and identity governance, with clear accountability for the credentials, scripts, and build paths each team controls. If no one owns the runtime trust boundary, detection becomes fragmented and response slows. The accountable team is the one that can approve, revoke, or isolate the compromised asset.
👉 Read our full editorial: OWASP A03 now frames software supply chain risk as runtime exposure
