{
  "abstract": "Modern software supply chains face increasing risks from vulnerable and anomalous dependencies, necessitating automated and interpretable detection methods integrated within Continuous Integration and Continuous Deployment (CI/CD) workflows. Open-source software (OSS) ecosystems are increasingly targeted by sophisticated attacks—including AI model poisoning, dependency confusion, contributor hijacking, and transitive dependency anomalies—that often evade traditional CVE-centric tools such as Snyk and Dependabot. These reactive solutions are primarily designed for known vulnerabilities and may exhibit high false-positive rates when applied to behavioral anomalies, while also lacking interpretable and actionable guidance for developers. This limitation creates a critical barrier to reliable and secure software development in modern DevSecOps environments. To address this gap, this paper introduces XAI-SCS, an intelligent, explainable decision-support framework for OSS supply chain security that performs metadata-driven behavioral risk assessment to proactively identify anomalous package activity. A hybrid CNN–LSTM–Autoencoder architecture achieves strong anomaly-detection performance on the held-out test set (F1 = 0.91), with low repeated-run variability (mean F1 = 0.90 ± 0.02 across five runs) on a federated dataset of 12,000 npm/PyPI package versions, primarily trained using CVE-linked labels and GAN-simulated poisoning samples. A separate held-out evaluation set of 240 manually curated real-world non-CVE OSS supply-chain incidents was used exclusively for external generalization assessment. Accordingly, the non-CVE results are interpreted as preliminary evidence of transferability to selected metadata-visible behavioral anomalies rather than comprehensive real-world non-CVE threat coverage. To support transparent developer decision-making, SHAP-based explanations and counterfactual remediation suggestions produced high perceived clarity (4.3 ± 0.4/5) and actionability (4.1 ± 0.5/5) and self-reported remediation intent (96%, n = 82). However, these findings reflect developer perceptions in a controlled study and do not yet demonstrate measured improvements in real-world remediation time, fix completion, or vulnerability resolution within operational DevSecOps teams. Optional high-assurance deployment extensions, including Federated Continual Learning, zero-knowledge attestation via zk-SNARKs, and post-quantum secure enclaves, are presented as exploratory architectural pathways for future privacy-preserving, verifiable, and confidential deployment, rather than as part of the core empirical evaluation. Embedded in controlled, CI/CD-representative workflows with 0.8-second average latency, XAI-SCS remains competitive with CVE-centric tools on known-vulnerability cases while providing preliminary evidence of complementary metadata-level behavioral risk screening in GAN-simulated and limited curated non-CVE evaluation subsets. The comparison is therefore interpreted as evidence that XAI-SCS can complement CVE-centric SCA tools by adding metadata-level behavioral screening and developer-facing explanations, rather than replacing or universally outperforming tools such as Snyk and Dependabot. This work’s primary contribution is a metadata-driven, CI/CD-integrated intelligent decision-support framework that delivers high-accuracy behavioral anomaly detection (F1 = 0.91) and transparent, developer-facing explanations (clarity 4.3/5, remediation intent 96%) for OSS supply chain risk assessment. Optional high-assurance deployment extensions (federated learning, cryptographic attestation, secure enclaves) are discussed separately and do not form part of the core empirical evaluation.",
  "abstract_shown": true,
  "affiliations": [],
  "article_type": null,
  "arxiv": null,
  "author_total": 2,
  "authors": [
    {
      "name": "Ahmed Alzahrani",
      "orcid": "0000-0002-5010-3249"
    },
    {
      "name": "Muhammad Zubair Asghar",
      "orcid": "0000-0003-3320-2074"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/194rr6ndfdxxd.bib",
  "cited_by": 0,
  "doi": "10.1038/s41598-026-69729-3",
  "fulltext_url": "https://doi.org/10.1038/s41598-026-69729-3",
  "id": "194rr6ndfdxxd",
  "issns": [
    "2045-2322"
  ],
  "landing_url": "https://www.nature.com/articles/s41598-026-69729-3",
  "language": "en",
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0",
  "metadata_licence": null,
  "native_subjects": [
    [
      "lcc",
      "Q"
    ],
    [
      "lcc",
      "R"
    ],
    [
      "openalex",
      "1710|Software Engineering Research"
    ]
  ],
  "openalex": "W7204164787",
  "pdf_url": "https://www.nature.com/articles/s41598-026-69729-3.pdf",
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-03",
  "publisher": "Springer Science and Business Media LLC",
  "ris": "https://research.draconitic.com/paper/194rr6ndfdxxd.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:17:19Z",
      "native_id": "10.1038/s41598-026-69729-3",
      "source": "crossref",
      "url": "https://www.nature.com/articles/s41598-026-69729-3"
    },
    {
      "first_seen": "2026-10-30T13:45:54Z",
      "native_id": "c2d64cf6d68c48ef92077147e73129a4",
      "source": "doaj",
      "url": "https://doi.org/10.1038/s41598-026-69729-3"
    }
  ],
  "subjects": [
    {
      "field": "medicine",
      "origin": "lcc:R",
      "subfield": "general"
    }
  ],
  "title": "Securing the open-source ecosystem: AI-enhanced and explainable supply chain security for reliable software development",
  "title_text": "Securing the open-source ecosystem: AI-enhanced and explainable supply chain security for reliable software development",
  "type": "peer-reviewed",
  "updated_at": "2026-10-30T13:45:54Z",
  "url": "https://research.draconitic.com/paper/194rr6ndfdxxd",
  "venue": "Scientific Reports",
  "versions": []
}