Dependency Trust Signals Are a Market for Lemons, and 54.6% of Published Advice Comes With No Action Taken

arXiv 2608.20678·medium signalXBlueskyLinkedInCopy link

The Software Supply Chain as a Market for Lemons (arXiv 2608.20678, Aug 21) codes 252 Google Search sources and 870 Reddit threads on how practitioners judge open-source dependencies. It finds cheap signals such as stars, download counts and contributor activity collapsing under three simultaneous forces: adversarial manipulation, gaming indistinguishable from legitimate behavior, and non-adversarial inflation driven by legitimate AI tooling. Documented responses were mostly advisory, with 54.6% of Google Search sources offering advice and no actual action taken, and proposed remedies substituted one gameable signal for another. The authors argue costlier signals like cryptographic attestation need to be mandatory rather than voluntary.