  The software product is a source of cyber-attacks that target organizations
by using their software supply chain as a distribution vector. As the reliance
of software projects on open-source or proprietary modules is increasing
drastically, SSC is becoming more and more critical and, therefore, has
attracted the interest of cyber attackers. While existing studies primarily
focus on software supply chain attacks' prevention and detection methods, there
is a need for a broad overview of attacks and comprehensive risk assessment for
software supply chain security. This study conducts a systematic literature
review to fill this gap. We analyze the most common software supply chain
attacks by providing the latest trend of analyzed attacks, and we identify the
security risks for open-source and third-party software supply chains.
Furthermore, this study introduces unique security controls to mitigate
analyzed cyber-attacks and risks by linking them with real-life security
incidence and attacks.
