Software Supply-Chain Security in the Age of Artificial Intelligence: A Systematic Survey of Dependency Risks, AI-Generated Code, and Defense Frameworks

Modern software is assembled more than it is written: a typical application depends on hundreds of open-source packages, build tools, containers, and services, each of which is a point where trust can be broken. At the same time, artificial intelligence is changing both sides of this equation — large language models now write a growing share of the code that enters the supply chain, while attackers use the same models to find, poison, and exploit it. This paper presents a systematic survey of software supply-chain security in the age of artificial intelligence. It reviews the anatomy of the modern software supply chain and the major incidents that defined the field, from SolarWinds and Log4Shell to the xz backdoor; it presents a taxonomy of supply-chain attacks organized by the stage they compromise; it examines the security properties of the large package ecosystems npm, PyPI, and Maven; it analyzes how AI changes the threat landscape — through vulnerable AI-generated code, poisoning of code models, hallucinated package names, and AI-assisted attack automation — and how AI is also being used defensively; and it surveys the defense frameworks that have emerged in response, including SLSA, the NIST Secure Software Development Framework, software bills of materials, Sigstore, in-toto, and reproducible builds. The survey concludes that supply-chain security is fundamentally a problem of verifiable trust, that AI widens the attack surface faster than it strengthens the defenses, and that the field's most promising direction is the combination of provenance, policy enforcement, and measured dependency hygiene rather than any single tool or standard.