There is no “software supply chain”

The term 'software supply chain' is a buzzword that VC-backed security companies are pushing for marketing purposes.

I respectfully disagree with the conclusion.

No, hobbyists shouldn't be "required" to do anything. Volunteer time is volunteer time, and it's 100% the choice of the hobbyist to decide what they do and don't want to do.

And the metaphor "supply chain" may in fact be leaky, but all metaphors are leaky. There are a chain of dependencies that go from the lowest level all the way to a release piece of software. There's no requirement that the chain loops, though in fact it does loop: People making the software can easily be using some of the derived packages.

But honestly, if GitHub wants to say "lack of maintenance" is a vulnerability, well, they're pretty much correct. If GitHub also doesn't want to allow repos that many other users are reliant on to be closed down, so as to not break infrastructure, that's their right.

PRs can be ignored. If someone submits a PR to a repo and no one pays any attention, then it can be viewed and applied by someone else--someone who forks the repo. Maybe one of the forks will gain momentum and replace the repo with one that's being actively maintained.

If you don't like GitHub's policies, use GitLab or another service. There are alternatives. But it's not because they're calling it a supply chain that there's a problem; whatever you call it, if dependencies aren't being maintained then there's a potential for accumulating security holes, and those upstream have a right to be notified of such.

I get your point of view but isn't it just part and parcel of open-source? And you have the README anyway so if it was used and read how is supposed to be then there wouldn't be an issue.

Yeah, supply chain security is an issue. But how do you get anyone to agree to audit thousands of NPM dependencies? It just doesn't happen, unfortunately.