Name: When Dependencies Become Lemons: A Multivocal Review of Cheap Trust Signal Collapse in the Software Supply Chain - Ranindya Paramitha, North Carolina State University
Start: 2026-10-06T16:04:00+0200
End: 2026-10-06T16:22:00+0200

When Dependencies Become Lemons: A Multivocal Review of Cheap Trust Signal Collapse in the Software Supply Chain - Ranindya Paramitha, North Carolina State University

Tuesday October 6, 2026 16:04 - 16:22 CEST

South Hall 3A

Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, assuming those signals reflect genuine trustworthiness. Prior work has documented individual signal gaming, but the landscape of collapses across all dependency-adoption signals, as well as the ecosystem’s response, remains unexplored. The goal of this study is to aid software practitioners in understanding the reliability of dependency adoption trust signals, such as download counts and contributor activity, by conducting a multivocal review of 252 Google Search sources and 870 Reddit threads. After coding the corpora, we find that cheap trust signals collapse under three simultaneous forces: adversarial manipulation, gaming techniques indistinguishable from legitimate behavior, and non-adversarial AI-driven inflation. The documented responses are more advice than actual action: 54.6% of Google Search sources contain advice on what practitioners should do, with no actual action taken. Responses proposed substituting one cheap signal for another or aggregating multiple signals, which are now also gameable. Non-adversarial inflation, i.e., degradation caused by the emergence of legitimate AI tooling, lacks documented actual behavior change in either corpus. The gap between known remedy and actual practice points toward a market for lemons: when faking signals costs less than earning them, good and bad dependencies become indistinguishable. Relying on individual practitioners to verify the cheap signals is not sustainable. Costlier signals, such as cryptographic attestation, should be made mandatory so that they become the default for all, not a voluntary choice for the few.

Speakers

Ranindya Paramitha

North Carolina State University

Ranindya Paramitha is an incoming Lecturer at the University of Bristol, UK. The presented work was completed when she was a Postdoctoral Research Scholar at North Carolina State University, USA. She received her PhD from the University of Trento, Italy. Her research focuses on software... Read More →

Tuesday October 6, 2026 16:04 - 16:22 CEST
South Hall 3A

SCORED Sessions, SBOM and Beyond

OpenSSF Community Day Europe 2026

Ranindya Paramitha

Get help with the event

OpenSSF Community Day Europe 2026

Ranindya Paramitha

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Get help with the event