Today, most software is developed by leveraging existing packages, allowing developers to accelerate development. The proliferation of package dependencies creates a target-rich environment for malicious actors to inject malware, steal sensitive information, or cause destruction. Such supply-chain attacks constantly threaten package ecosystems such as Cargo, NPM, and Maven.

In this paper, we explore how to fight against such attacks by leveraging effect systems. While effect systems predict the behavior of software components, there is a practical gap between a programming language with an effect system and a programming language ecosystem that can use such effects to thwart attacks. To close this gap, we introduce a notion of effect-safe package upgrade and develop an effect-aware package manager that enforces safety through effect lock files.

We extend the Flix programming language and its compiler toolchain with an effect-aware package manager. We introduce the notion of secure, trusted, and unsafe packages to control access to the Java Class Library and Java Virtual Machine. We evaluate the usefulness of the proposed effect-aware package manager with a case study of 51 supply-chain attacks from the ``Backstabbers Knife Collection'' corpus of malware. The study suggests that 48 of these attacks are likely preventable with our proposed effect-aware package manager.