No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild

arXiv:2607.22140 · cs.SE, cs.CR · Submitted 2026-07-24 · Read on arXiv

Artur Zięba-Kozarzewski

cs.SE, cs.CR

Submitted: 2026-07-24

Comments: 7 pages, 1 figure, 3 tables

Code: https://github.com/anchore/syft

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

• Degeneracy — 6× in this paper · explained in 3 episodes
• Ablation — 3× in this paper · explained in 1 episode
• Generalization — 3× in this paper · explained in 13 episodes
• International Conference on Mining Software Repositories — 3× in this paper
• Accuracy — 2× in this paper · explained in 1 episode
• Consistency — 2× in this paper · explained in 3 episodes
• Adam — 1× in this paper · explained in 2 episodes
• Analyzer — 1× in this paper · explained in 1 episode
• Core — 1× in this paper · explained in 2 episodes
• Provenance — 1× in this paper · explained in 4 episodes
• Systematic Bias — 1× in this paper · explained in 3 episodes

Sources

• A Large Scale Empirical Analysis on the Adherence Gap between Standards and Tools in SBOM
• Wild SBOMs: a Large-scale Dataset of Software Bills of Materials from Public Code
• Taxonomy of Attacks on Open-Source Software Supply Chains
• Small World with High Risks: A Study of Security Threats in the npm Ecosystem
• Software Bills of Materials in Maven Central

Related papers

• Falsification-Based Verification of LLM-Generated Optimization Models: Sound Test Batteries and Their Detection Limits
• GitSkills: A Dataset of Agent Skills on GitHub
• SABER: Benchmarking Operational Safety of LLM Coding Agents in Stateful Project Workspaces
• PackMonitor: Enabling Zero Package Hallucinations Through Decoding-Time Monitoring
• IntentCoding: Amplifying User Intent in Code Generation
• Incentives and Outcomes in Bug Bounties