Dependency management used to be a private embarrassment: an Ant script, a /lib folder, and classpath roulette. You could ship anyway, and the consequences mostly stayed inside your org. 

*** This is a Security Bloggers Network syndicated blog from 2024 Sonatype Blog authored by Brian Fox. Read the original post at: https://www.sonatype.com/blog/trust-at-scale-the-commons-threats-and-ai-in-the-loop