I wrote a blog post

You don't have a supply chain, you have a supply soup

This is something I want to spend some time investigating in the future, it's all vastly more complicated and weird than we think it is

https://opensourcesecurity.io/2026/07-supply-soup/