Understanding security challenges in the software supply chain through causal relationships (PLOS ONE, 2026)