# Sonatype State of the Software Supply Chain

> The definitive annual report on open-source and software supply chain risk.

The report quantifies the explosion in open-source usage, the rise of malicious packages, and the gap between available fixes and adoption. It is essential reading for AppSec, DevSecOps, and platform teams.

- **Category:** [Research & Reports](https://gracker.ai/cyber-resources/research)
- **Website:** https://www.sonatype.com/state-of-the-software-supply-chain/introduction
- **Location:** Fulton, MD, USA
- **Verified:** Yes
- **Last updated:** June 9, 2026

## Frequently asked questions

### What is Sonatype State of the Software Supply Chain?

Sonatype's State of the Software Supply Chain analyzes open-source consumption, malicious package trends, and dependency risk across millions of projects. Published annually, it is the leading benchmark for software supply chain security.

### Where is Sonatype State of the Software Supply Chain based?

Sonatype State of the Software Supply Chain is based in Fulton, MD, USA.

### What is Sonatype State of the Software Supply Chain listed under on Cyber Resources?

Sonatype State of the Software Supply Chain is listed in the Research & Reports category of Cyber Resources, the curated directory of the cybersecurity marketing and growth ecosystem.