# Government Suppliers Secure Software Repositories

Repo squatting uses lookalike repository names to redirect developers, dependency managers, or CI pipelines to malicious code. Although the signal identifies no contract or solicitation, the threat is relevant to government procurement because contractors and suppliers may introduce compromised dependencies into software delivered to agencies. The article recommends maintaining approved-source inventories, verifying repository ownership and software provenance, and requiring integrity checks before dependencies enter build workflows.

- Contractors can use approved-source inventories and repository ownership checks to reduce the risk of malicious dependencies entering development and delivery pipelines.
- Procurement teams evaluating software suppliers can assess how suppliers verify software provenance and integrity within their build workflows.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity
**Published:** October 24, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)

### Sources
- [What Is Repo Squatting? Definition & Examples](https://nhimg.org/glossary/repo-squatting) - Non-Human Identity Management Group