ESPR: An Ethereum-Sourced Package Registry for Software Supply Chain Security

Abstract

We present the Ethereum-Sourced Package Registry (ESPR), an open-source implementation of a blockchain-based software package registry. Software supply chain security is a developing field in cybersecurity which ESPR aims to contribute to. ESPR uses smart contracts to maintain package information while storing package files off-chain using IPFS. ESPR also includes a website interface to easily interface with the smart contracts. We demonstrate that ESPR is less vulnerable to certain supply-chain attacks through its decentralized structure. Although our application presents financial costs to package developers, we explore strategies to mitigate them and provide a comparative analysis against centralized package hosting solutions.