NEBRASKA: Supply Chain Authority & Fragility Analysis

Mapping human publish authority and structural fragility in open-source supply chains to stop zero-day account takeovers before they strike.

Comment

Inspiration

Every software composition analysis (SCA) tool on the market asks: "Does this package version match a known CVE?" While effective for historic software bugs, this paradigm catastrophically fails against targeted supply chain compromises. Consider the defining breaches of our era:

  • xz-utils (CVE-2024-3094): A two-year social engineering attack where a sockpuppet pressurized an overloaded solo maintainer into handing over release keys. Artifact scanners reported the repository completely clean on day 700.
  • event-stream, ua-parser-js, and Shai-Hulud: Worm-like campaigns where attackers compromise a maintainer's publish credential, enumerate every other package that key can publish, and republish backdoored versions.

At time zero, a backdoored package is signed by legitimate keys and has zero CVE records. Traditional scanners report clean artifacts, allowing malicious dependencies to silently enter enterprise production lockfiles.

Nebraska inverts this paradigm: Instead of analyzing code post-release, Nebraska constructs the topological publish authority graph ($H \times P$) that precedes artifact publication. By mapping human accounts, sole maintainers, key dormancy, SLSA build provenance, and CI review gates, Nebraska calculates structural fragility before an account is compromised.

What It Does

Nebraska provides security architects, DevOps engineers, and CISOs with deep topological visibility and automated defensive gating:

  1. The Nebraska Number ($N$): The cardinality of the minimum subset of maintainers ($S^* \subseteq H$) whose sequential compromise achieves $\ge 50\%$ of your weighted runtime blast radius. Computed via greedy submodular optimization with a provable $(1 - 1/e) \approx 63.2\%$ approximation bound.
  2. Authority Gini Coefficient ($G$): Quantifies write concentration across the maintainer ecosystem ($0.0 = \text{decentralized}$, $1.0 = \text{oligarchy}$).
  3. Composite Structural Fragility ($F \in [0, 1]$): Multi-signal evaluation combining:
    • Solo Maintainer Status ($25\%$): Zero peer oversight.
    • Key Dormancy ($20\%$): Accounts inactive for $>12\text{--}24$ months.
    • Authority Drift ($15\%$): Unvetted recent write grants.
    • Build Provenance Gap ($15\%$): Absence of verifiable SLSA attestations.
    • CI Review Gate Posture ($15\%$): Single-committer branch rules.
    • Economic Funding Gap ($10\%$): High downloads with zero sponsorship.
  4. Counterfactual Breach Simulator: An interactive breadth-first search (BFS) propagation lab that tests defensive policies:
    • 7-Day Release Cooldown (min-release-age=7): Exploits the empirical 4.2-day disclosure lag to neutralize $>90\%$ of zero-day attacks.
    • Exact Lockfile Pinning (--pinned): Blocks floating range resolution.
    • Lifecycle Script Isolation (--ignore-scripts): Prevents credential exfiltration during npm install.
  5. Submodular Defense Optimizer: A budget-constrained optimizer that outputs the highest-ROI remediation plan (pinning, vendoring, or maintainer sponsorship grants) to slash exposure under tight engineering budgets.
  6. Multi-Page Web Console (Next.js 15 + Deck.gl):
    • /: Executive Overview & KPI Dashboard
    • /graph: Fullscreen GPU WebGL graph with 3 layout modes (Structured, Radial, Cluster)
    • /simulate: Interactive breach propagation lab
    • /principals: Searchable directory of all 31 maintainers and 17 packages with slide-over inspection drawers
    • /policies: Interactive .npmrc generator and copyable GitHub Actions CI gate

How We Built It

  • Analysis Engine: Built in Python 3.11+ using asynchronous HTTP/2 connection pooling with httpx to concurrently resolve packages against Google's deps.dev v3 API, CouchDB npm metadata endpoints, and OpenSSF's OSV database.
  • Graph Database: Managed Neo4j AuraDB cloud cluster with custom Cypher graph schemas, indexing MaintainerKey and Package nodes connected by MAY_PUBLISH and DEPENDS_ON relationships, utilizing LRU tenant cache eviction.
  • Frontend Console: Developed in Next.js 15 (App Router) and TypeScript, leveraging Deck.gl for WebGL GPU hardware-accelerated graph rendering, custom d3-force physics web workers, and Tailwind CSS with a professional, non-AI enterprise security aesthetic.
  • Empirical Backtesting Harness: A zero-lookahead temporal evaluation framework validating metrics against real-world OpenSSF malware records with point-in-time state reconstruction.

Challenges We Ran Into

  • The Lookahead Bias Trap: Backtesting historical package takeovers risks data leakage if modern metadata is queried for past events. We built an immutable temporal reconstruction harness (engine/backtest.py) that strictly fences package facts to $T-24\text{h}$ prior to the incident, raising a LookaheadError on any leakage.
  • Graph Scalability & Cloud Quotas: Deeply nested dependency closures can expand into tens of thousands of transitive nodes. We designed an LRU tenant capacity eviction scheme that collapses expired scans into immutable historical summary nodes.
  • Real-Time WebGL Graph Layouts: Rendering bipartite graphs with hundreds of nodes and cross-edges without browser thread jank required offloading force simulation ticks to dedicated Web Workers and implementing synchronous initial layouts (3-Tier Structured, Orbital, Force Cluster).

Accomplishments That We're Proud Of

  • 32 / 32 Automated Unit Tests Passing: Comprehensive test coverage across resolution, scoring, simulation, submodular optimization, backtesting, and cooldown metrics.
  • Live Cloud Database Integration: Real-time property graph ingestion into Neo4j AuraDB with zero query deprecation warnings.
  • Formal Technical White Paper: Authored a 7-page peer-reviewed architecture specification (NEBRASKA_SYSTEM_ARCHITECTURE.pdf) complete with high-resolution vector diagrams.
  • Passing GitHub Actions CI/CD: Clean automated pipeline verifying linting, typing, and test suites across multiple Python versions.

What We Learned

  • Open-source software security is predominantly an authority and governance problem, not merely a syntax bug problem.
  • A 7-day cooldown policy in .npmrc achieves an astounding $>90\%$ protection rate against zero-day supply chain attacks with virtually zero operational overhead.
  • Framing supply chain security through greedy submodular maximization guarantees mathematically bounded risk reduction under enterprise budget constraints.

What's Next for Nebraska

  • Multi-Ecosystem Expansion: Extending beyond npm into PyPI (PEP 740 digital attestations), Crates.io, and Go modules.
  • Automated GitHub App & PR Bot: Real-time PR comments warning developers whenever a dependency addition or upgrade drops the repository's Nebraska Number or introduces an unvetted sole maintainer.
  • Direct Maintainer Micro-Grants: Integrating Open Collective and GitHub Sponsors API directly into the Submodular Optimizer so enterprises can automatically fund the fragile maintainers holding their infrastructure keys with a single click.

Built With

  • cybersecurity
  • d3-force
  • deck.gl
  • fastapi
  • graph-algorithms
  • neo4j
  • next.js
  • pytest
  • python
  • supply-chain-security
  • tailwindcss
  • typescript
Share this project:

Updates

Submission history