# The CHAINS research project on software supply chains @ KTH

    .d8888b. 888    888        d8888 8888888 888b    888  .d8888b.

CHAINS is a research project at KTH Royal Institute of Technology , it is about hardening the software supply chain, incl. dependency engineering as well as reproducible, executable and verifiable builds and SBOMs. We primarily look at Maven, NPM, and the software supply chain of crypto. The project is funded by the Swedish Foundation for Strategic research (SSF) . We are recruiting software engineers, postdocs, and interns, get in touch!

        <dependency>
          <groupId>com.martiansoftware</groupId>
          <artifactId>jsap</artifactId>
          <version>2.1</version>
        </dependency>
        <dependency>
          <groupId>org.slf4j</groupId>
          <artifactId>slf4j-api</artifactId>
          <version>1.7.36</version>
        </dependency>
        <dependency>
          <groupId>commons-io</groupId>
          <artifactId>commons-io</artifactId>
          <version>2.11.0</version>
        </dependency>

## Papers & Theses

(chronological order)

- The Multibillion Dollar Software Supply Chain of Ethereum , IEEE Computer, 2022
- Diverse Double-Compiling to Harden Cryptocurrency Software , Master’s thesis Niklas Rosencrantz, 2023
- Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js , Usenix Security 2023
- Challenges of Producing Software Bill Of Materials for Java , IEEE Security & Privacy, 2023

Posts:

- CHAINS contributions to open-source
- Dependency Resolution in Different Ecosystems
- The CHAINS software supply chain recommendations
- An overview of Reproducible Builds Summit 2023

## Team

- Principal Investigators: [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted]
- PhD students: [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted]
- Research engineers & assistants: [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted]
- Master’s students: [Name Redacted] , [Name Redacted]

Chains alumni: [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted] , [Name Redacted]

## Events & Talks

- May 23 2024: Chains talk at Dataföreningen
- April 26 2024: 3rd KTH Workshop on the Software Supply Chain
- Nov 26 2023: The Chains SBOM orchestra at SCORED , Chains Team, SCORED 2023 , Copenhagen
- October 2023: A Runtime Integrity Tool for Java Dependencies (Aman Sharma et al.). Poster at SecDev 2023

## Press

- June 12 2024: Framtidens Forskning (In Swedish)
- June 17 2022: Framtidens Forskning (In Swedish)

## Repositories

See [URL Redacted]

## Master / Internship topics

- CHAINS master’s thesis topics
- [URL Redacted]
- [URL Redacted]
- [URL Redacted] .