direction: right

producteur: "Producer" { class: muted }

source: "Source" {
  a: "A · Malicious producer" { class: danger }
  b: "B · Modify the source\nwithout review" { class: danger }
  c: "C · Abuse source control\nadmin privileges" { class: danger }
}

build: "Build" {
  d: "D · Unofficial build\nparameters" { class: danger }
  e: "E · Compromise the\nbuild process" { class: danger }
  f: "F · Tamper with the\nartifact on upload" { class: danger }
}

distribution: "Distribution" {
  g: "G · Compromise the\ndistribution channel" { class: danger }
}

usage: "Consumer usage" {
  h: "H · Wrong package\nselection (typosquat)" { class: danger }
  i: "I · Insecure use\nof the package" { class: danger }
}

dependances: "Dependencies"

producteur -> source
source -> build
build -> distribution
distribution -> usage
dependances -> build
distribution -> dependances { class: indirect }