Addressing Risks Associated with Extended Software Supply Chain