The open-source software (OSS) ecosystem is the foundation of modern digital infrastructure, but its complex and decentralized supply chain has become a prime target for malicious actors. While traditional security mechanisms typically focus on package dependencies, they often overlook critical blind spots inherent to version control system (VCS) workflows. In this talk, we illustrate how Software Heritage (SWH), the largest universal source code archive, serves not just as a library for code preservation, but as a proactive research and resilience infrastructure for cybersecurity.
Drawing from recent works in the SWHSec project [3], we will illustrate how large-scale historical analysis can detect hidden supply chain threats that conventional scanners miss:
- The Forking Blind Spot: Vulnerabilities do not only propagate through dependencies; they spread through code forks. When a vulnerability is patched upstream, downstream forks often remain silently exposed. By leveraging the SWH global graph for commit-level history analysis across 2.2 million forks, we successfully tracked and identified 135 high-severity one-day (known but unpatched) vulnerabilities, proving that global provenance analysis is crucial for securing decentralized codebases.
- Altered Histories and Covert Attacks: While rewriting Git history (e.g., force-pushing) has legitimate use cases, it breaks repository integrity and creates opportunities for attackers to stealthily insert nefarious changes or erase traces of compromised secrets. Because Software Heritage preserves VCS histories immutably, even after upstream alterations, colleagues analyzed 111 million repositories to uncover 8.7 million rewritten histories. They will introduce GitHistorian, an automated tool designed to spot these alterations and bad practices.

To conclude, we will outline the strategic roadmap for Software Heritage as an indispensable cybersecurity tool. By transitioning from a massive observational archive to an active defense mechanism, SWH will pave the way for real-time anomaly detection, global code provenance tracking, and the proactive prevention of next-generation open-source supply chain attacks.

[1] https://arxiv.org/abs/2511.05097
[2] https://hal.science/hal-05249034v2/document
[3] https://swhsec.github.io/