A03:2025 — Software Supply Chain Failures
What are Software Supply Chain Failures (OWASP A03:2025)?
NEW in 2025. Expands the previous "Vulnerable and Outdated Components" to cover the entire software supply chain ecosystem: compromised packages, malicious code injection during build processes, tampered dependencies, vulnerable build pipelines, and unverified software distribution. Encompasses risks from dependency confusion, typosquatting, and build system compromises.
Impact
New category driven by high-profile incidents like the XZ Utils backdoor (CVE-2024-3094), SolarWinds, and Codecov attacks. Recognizes that supply chain integrity is now a top national security concern.
How Precogs AI Addresses A03
Precogs AI Binary SAST compares binary signatures against known-good builds to detect supply chain tampering, identifies compromised dependencies in compiled artifacts, and scans for malicious code injected during build processes.