The Software Supply Chain as a Market for Lemons: A Multivocal Review of Trust Signal Collapse

2026-08-20

AI Summary

研究通过多声部审查方法探讨了开源依赖信任信号（如下载量和贡献者活动）的可靠性问题，揭示了这些信号因对抗性操纵、难以区分的游戏技术和非对抗性的AI驱动膨胀而失效的现象。

Abstract

Practitioners evaluating open-source dependencies rely on cheap trust signals, e.g., stars, download counts, and contributor activity, as substitutes for direct code inspection, assuming those signals reflect genuine trustworthiness. Prior work has documented individual signal gaming, but the landscape of collapses across all dependency-adoption signals, as well as the ecosystem's response, remains unexplored. The goal of this study is to aid software practitioners in understanding the reliability of dependency adoption trust signals, such as download counts and contributor activity, by conducting a multivocal review of 252 Google Search sources and 870 Reddit threads. After coding the corpora, we find that cheap trust signals collapse under three simultaneous forces: adversarial manipulation, gaming techniques indistinguishable from legitimate behavior, and non-adversarial AI-driven inflation. The documented responses are more advice than actual action: 54.6% of Google Search sources contain advice on what practitioners should do, with no actual action taken. Responses proposed substituting one cheap signal for another or aggregating multiple signals, which are now also gameable. Non-adversarial inflation, i.e., degradation caused by the emergence of legitimate AI tooling, lacks documented actual behavior change in either corpus. The gap between known remedy and actual practice points toward a market for lemons: when faking signals costs less than earning them, good and bad dependencies become indistinguishable. Relying on individual practitioners to verify the cheap signals is not sustainable. Costlier signals, such as cryptographic attestation, should be made mandatory so that they become the default for all, not a voluntary choice for the few.

Problem

• trust signals
• software supply chain
• dependency adoption
• adversarial manipulation
• non-adversarial AI-driven inflation

Innovation

• cheap trust signals
• adversarial manipulation
• AI-driven inflation
• cryptographic attestation