Package inventory tells you what is present, while package trust asks whether the package behaved safely at install, import, and runtime. A dependency can be accurately inventoried and still be malicious, as this incident shows. Practitioners need both provenance controls and behavioural checks because presence alone does not prove safety.
Inventory answers the “what exists” question
Package inventory is the discovery layer. It records which packages, versions, transitive dependencies, and sometimes metadata such as source, owner, or environment are present in a system or build. That visibility is essential for exposure management, patching, and license or policy review, but it only tells you that something was found, not whether it is trustworthy.
An accurate inventory can still miss the security meaning of the package itself. A dependency may be present in the right repository, registered in the right catalog, and still be malicious, tampered with, or simply inappropriate for the environment. That is why inventory is necessary for control, but never sufficient for trust.
Trust asks whether the package should be allowed to run
Package trust evaluates the package as an active component in the delivery chain. It looks at provenance, publisher identity, signing or attestation where available, install-time behavior, import-time behavior, runtime behavior, and whether the package respects the assumptions of the environment. In supply chain security, trust is a verification problem, not a naming problem.
This distinction matters because the package can behave safely at one stage and dangerously at another. A package may install cleanly but execute a malicious postinstall script, exfiltrate secrets during import, or activate only under certain runtime conditions. Current guidance suggests treating trust as a combination of origin, integrity, and observed behavior, not as a static label attached to the package name.
LiteLLM PyPI package breach illustrates the gap well: inventory could still show the dependency correctly, while trust failed because the package's behavior created real exposure. The practical lesson is that “known package” and “safe package” are separate questions.
Why the difference matters in real supply chain controls
Inventory supports breadth, trust supports assurance. Inventory is how you find out what must be assessed, and trust is how you decide whether it can be promoted, executed, or retained. Teams that stop at inventory often overestimate their security because their catalog looks complete while untrusted packages still enter build pipelines, containers, notebooks, or runtime environments.
Provenance controls and behavioral checks work together here. Provenance helps answer where the package came from and whether it was produced through an expected process. Behavioral checks help answer whether the package performs actions that are inconsistent with its stated purpose, such as network beacons, credential access, or unexpected code execution. A strong program uses both, because each covers a different failure mode.
AI Supply Chain Security and AI-BOM Guide is useful for readers who need to connect package inventory with provenance and dependency governance across modern software stacks. For software artifact integrity, SLSA gives a supply-chain integrity lens that complements package inventory by focusing on how artifacts were built and whether that path can be trusted.
Risk and Threat Considerations
Inventory without trust creates false assurance. The main risk is assuming that visibility equals safety, when a malicious or compromised package can be perfectly visible in a catalog and still execute harmful behavior. Attackers exploit that gap because dependency systems often trust package names, publishers, or version records more readily than actual runtime behavior.
Failure mechanism: A dependency is enumerated correctly, but its provenance is weak, its install or import path contains executable abuse, or its runtime actions exceed what the team expected. That lets a package pass inventory-based reviews while still delivering credential theft, exfiltration, persistence, or other supply-chain compromise.
Impact: The environment accepts an untrusted component as if it were normal software. That can turn a routine dependency update into a compromise path for secrets exposure, build contamination, or downstream distribution of malicious code.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
SLSA, OWASP ASVS, CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| SLSA | Supply-chain Levels for Software Artifacts | Package trust depends on build provenance and artifact integrity. |
| Recommendation — Adopt SLSA-aligned provenance checks before promoting third-party packages. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Package behavior and dependency trust affect secure architecture and third-party code handling. |
| Recommendation — Review dependency behavior and trust assumptions as part of secure architecture decisions. | ||
| CIS Controls v8 | CIS-15 — Service Provider Management | Supply chain security depends on trusted third-party software and supplier assurance. |
| Recommendation — Assess third-party package sources and approval paths before deployment. | ||
| NIST CSF 2.0 | PR.DS-08 — Integrity of Data at Rest Is Protected | Package integrity and tamper resistance are central to trusting delivered artifacts. |
| Recommendation — Protect artifact integrity controls across acquisition, storage, and deployment. | ||
| NIST SP 800-53 Rev 5 | SA-12 — Supply Chain Protection | Supply chain assurance directly covers provenance and package trust decisions. |
| Recommendation — Apply supply chain protection controls to validate package provenance and integrity. | ||
Practitioner Guidance
What to verify: Treat inventory as the first filter, then verify provenance, integrity, and install or runtime behavior before allowing the package into a trusted path. If your control can only tell you that a package is present, it is an inventory control, not a trust control.
Decision rule: If a package is visible but cannot be traced to a trustworthy source or demonstrates unexpected behavior during install, import, or execution, treat it as untrusted even when it is already approved in inventory. Conversely, a package with strong provenance still needs behavior checks if it can execute code or reach sensitive data.
Practitioner takeaway: The mature control model is “discover, then trust, then allow,” not “discover therefore allow”; inventory reduces blind spots, but trust is what prevents a known dependency from becoming a hidden compromise path.
Related resources from NHI Mgmt Group
- What is the difference between provenance and simple software inventory in supply chain security?
- What is the difference between SaaS supply chain security and software supply chain security?
- What is the difference between secret rotation and supply chain trust controls?
- What is the difference between software supply chain security and application security in agentic pipelines?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org