Blockchain-Integrated Software Bill of Materials (SBOM) for Real-Time Vulnerability Detection in Decentralized Package Repositories

Abstract

As the software supply chain becomes increasingly decentralized, ensuring the integrity and security of software components has become a critical priority. This paper presents a blockchain-integrated Software Bill of Materials (SBOM) framework designed to facilitate real-time vulnerability detection across decentralized package repositories. By leveraging blockchain’s immutable ledger and decentralized consensus mechanisms, the proposed solution enhances transparency, automates component verification, and provides a tamper-resistant audit trail for all software artifacts. The architecture incorporates smart contracts to enable automatic alerts for security vulnerabilities, expired components, and compliance violations based on real-time threat intelligence and CVE databases. A layered design approach is employed, incorporating system modeling, integration strategies, and a performance assessment conducted through simulation of real-world distributed repositories. Evaluation metrics include latency reduction, detection accuracy, and scalability under distributed workloads. This framework aligns with emerging software supply chain security mandates, including SBOM adoption in accordance with global cybersecurity policies. By synthesizing contributions from over 80 peer-reviewed studies between 2019 and 2023, the paper offers a comprehensive and future-proof strategy for enhancing the trustworthiness of software ecosystems in decentralized environments.