Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Open accessThe claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Software supply chain attacks are becoming increasingly diverse and sophisticated, evolving from simple typosquatting to complex social engineering attacks as in the xz attack and reputation farming.
“Also, software supply chain attacks are becoming increasingly diverse and sophisticated, evolving from simple typosquatting [72] to complex social engineering attacks as in the xz attack [11] and reputation farming [18].”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [72]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
On the impact of security vulnerabilities in the npm package dependency network
Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236 · see citing works
Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint
Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147 · see citing works
Detecting Suspicious Package Updates
Garrett, K. A., Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2019) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier.2019.00012 · Cited by 59 · see citing works
Identification of Dependency-based Attacks on Node.js
Pfretzschner, B., & Othmane, L. B. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3120928 · Cited by 39 · see citing works
Poisoning the software supply chain
Levy, E. (2003) · IEEE Security & Privacy · doi:10.1109/msecp.2003.1203227 · Cited by 34 · see citing works
Security of public continuous integration services
Gruhn, V., Hannebauer, C., & John, C. (2013) · International Symposium on Open Collaboration · doi:10.1145/2491055.2491070 · Cited by 24 · see citing works
An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications
Ruohonen, J. (2018) · International Workshop on Empirical Software Engineering in Practice (IWESEP) · doi:10.1109/iwesep.2018.00013 · Cited by 20 · see citing works
Security Issues in Language-based Software EcosystemsPreprint
Vaidya, R. K., Carli, L. D., Davidson, D., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.02613 · Cited by 3 · see citing works
Flagged first, then by citations
1 of the 9 references couldn’t be matched to a known paper.
Research works printed but not linked: 1
- [36]Tschacher, N.P.: Typosquatting in programming language package managers. Master’s thesis, Universität Hamburg, Fachbereich Informatik (2016)
Cited by
Sorted by citations
Evaluating Large Language Models Trained on Code
Chen, M., Tworek, J., Jun, H., Yuan, Q., Pinto, H. P. D. O., Kaplan, J., Edwards, H., Burda, Y., Joseph, N., Brockman, G., et al. (2021) · arXiv · doi:10.48550/arxiv.2107.03374 · Cited by 1,436 · see citing works
“20 Also worrying is the possibility of Codex suggesting malicious or typosquatted packages (Ohm et al., 2020).”
BackgroundSoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Ladisa, P., Plate, H., Martinez, M., & Barais, O. (2023) · 2023 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46215.2023.10179304 · Cited by 208 · see citing works
Self-citationWhat are weak links in the npm supply chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513044 · Cited by 104 · see citing works
An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead
Xia, B., Bi, T., Xing, Z., Lu, Q., & Zhu, L. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00219 · Cited by 101 · see citing works
Reproducible Builds: Increasing the Integrity of Software Supply Chains
Lamb, C., & Zacchiroli, S. (2021) · IEEE Software · doi:10.1109/ms.2021.3073045 · Cited by 90 · see citing works
Practical automated detection of malicious npm packages
Sejfia, A., & Schäfer, M. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510104 · Cited by 86 · see citing works
On the impact of security vulnerabilities in the npm and RubyGems dependency networks
Zerouali, A., Mens, T., Decan, A., & Roover, C. D. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10154-1 · Cited by 69 · see citing works
Stalnaker, T., Wintersgill, N., Chaparro, O., Penta, M. D., Germán, D. M., & Poshyvanyk, D. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3623347 · Cited by 66 · see citing works
Cybersecurity and Forensics in Connected Autonomous Vehicles: A Review of the State-of-the-Art
Sharma, P., & Gillanders, J. (2022) · IEEE Access · doi:10.1109/access.2022.3213843 · Cited by 61 · see citing works
Towards detection of software supply chain attacks by forensic artifacts
Ohm, M., Sykosch, A., & Meier, M. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3409183 · Cited by 58 · see citing works
Self-citationAnomalicious: Automated Detection of Anomalous and Potentially Malicious Commits on GitHub
Gonzalez, D., Zimmermann, T., Godefroid, P., & Schaefer, M. (2021) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00035 · Cited by 56 · see citing works
SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties
Okafor, C., Schorlemmer, T. R., Torres-Arias, S., & Davis, J. C. (2022) · doi:10.1145/3560835.3564556 · Cited by 56 · see citing works
LastPyMile: identifying the discrepancy between sources and packages
Vu, D., Massacci, F., Николаевич, П. И., Plate, H., & Sabetta, A. (2021) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3468264.3468592 · Cited by 56 · see citing works
Self-citationAn Empirical Study of Malicious Code In PyPI Ecosystem
Guo, W., Xu, Z., Liu, C., Huang, C., Fang, Y., & Liu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00135 · Cited by 53 · see citing works
Analysis of security and privacy challenges for DNA-genomics applications and databases
Arshad, S., Arshad, J., Khan, M. M., & Parkinson, S. (2021) · Journal of Biomedical Informatics · doi:10.1016/j.jbi.2021.103815 · Cited by 47 · see citing works
Teichmann, F. M. J., Boticiu, S. R., & Sergi, B. S. (2023) · International Cybersecurity Law Review · doi:10.1365/s43439-023-00095-w · Cited by 46 · see citing works
Online Banking User Authentication Methods: A Systematic Literature Review
Karim, N. A., Khashan, O. A., Kanaker, H., Abdulraheem, W. K., Alshinwan, M., & Al-Banna, A.-K. (2023) · IEEE Access · doi:10.1109/access.2023.3346045 · Cited by 45 · see citing works
Wani, M. S., Kretschmer, M., Schröder, B., Grebe, A., & Rademacher, M. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3430823 · Cited by 44 · see citing works
On the Feasibility of Supervised Machine Learning for the Detection of Malicious Software Packages
Ohm, M., Boes, F., Bungartz, C., & Meier, M. (2022) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3538969.3544415 · Cited by 35 · see citing works
Self-citationHamer, S., d’Amorim, M., & Williams, L. A. (2024) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw63631.2024.00014 · Cited by 37 · see citing works
Maltracker: A Fine-Grained NPM Malware Tracker Copiloted by LLM-Enhanced Dataset
Yu, Z., Wen, M., Guo, X., & Jin, H. (2024) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3650212.3680397 · Cited by 33 · see citing works
On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI
Ladisa, P., Ponta, S. E., Ronzoni, N., Martínez, M., & Barais, O. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627138 · Cited by 30 · see citing works
Ismail, S. S., Dandan, S., Dawoud, D. W., & Reza, H. (2024) · IEEE Access · doi:10.1109/access.2024.3432454 · Cited by 29 · see citing works
Software Bill of Materials Adoption: A Mining Study from GitHub
Nocera, S., Romano, S., Penta, M. D., Francese, R., & Scanniello, G. (2023) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme58846.2023.00016 · Cited by 28 · see citing works
On the feasibility of detecting injections in malicious npm packages
Scalco, S., Paramitha, R., Vu, D., & Massacci, F. (2022) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3538969.3543815 · Cited by 27 · see citing works
An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures
Singla, T., Anandayuvaraj, D., Kalu, K. G., Schorlemmer, T. R., & Davis, J. C. (2023) · Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses · doi:10.1145/3605770.3625214 · Cited by 26 · see citing works
On the Correctness of Metadata-Based SBOM Generation: A Differential Analysis Approach
Yu, S., Song, W., Hu, X., & Yin, H. (2024) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn58291.2024.00018 · Cited by 26 · see citing works
Bad Snakes: Understanding and Improving Python Package Index Malware Scanning
Vu, D., Newman, Z., & Meyers, J. S. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00052 · Cited by 25 · see citing works
Zhang, J., Wu, P., London, J., & Tenney, D. (2025) · IEEE Access · doi:10.1109/access.2025.3540075 · Cited by 30 · see citing works
Investigating Package Related Security Threats in Software Registries
Gu, Y., Ying, L., Pu, Y., Hu, X., Chai, H., Wang, R., Gao, X. H., & Duan, H. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179332 · Cited by 24 · see citing works
Jôrgensen, B. N., & Ma, Z. G. (2026) · Applied Sciences · doi:10.3390/app16020981 · Cited by 29 · see citing works
Automated unearthing of dangerous issue reports
Pan, S., Zhou, J., Cogo, F. R., Xia, X., Bao, L., Hu, X., Li, S., & Hassan, A. E. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3549156 · Cited by 23 · see citing works
Li, N., Wang, S., Feng, M., Wang, K., Wang, M., & Wang, H. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00073 · Cited by 23 · see citing works
Reusing Deep Learning Models: Challenges and Directions in Software Engineering
Davis, J. C., Jajal, P., Jiang, W., Schorlemmer, T. R., Synovic, N. M., & Thiruvathukal, G. K. (2023) · IEEE John Vincent Atanasoff International Symposium on Modern Computing (JVA) · doi:10.1109/jva60410.2023.00015 · Cited by 23 · see citing works
A Needle is an Outlier in a Haystack: Hunting Malicious PyPI Packages with Code Clustering
Liang, W., Ling, X. G., Wu, J., Luo, T., & Wu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00085 · Cited by 22 · see citing works
Evolving collaboration, dependencies, and use in the Rust Open Source Software ecosystem
Schueller, W., Wachs, J., Servedio, V. D. P., Stefan Thurner, A., & Loreto, V. (2022) · Scientific Data · doi:10.1038/s41597-022-01819-z · Cited by 21 · see citing works
On the prevalence of software supply chain attacks: Empirical study and investigative framework
Andreoli, A., Lounis, A., Debbabi, M., & Hanna, A. (2023) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2023.301508 · Cited by 21 · see citing works
"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain
Wermke, D., Klemmer, J. H., Wöhler, N., Schmüser, J., Ramulu, H. S., Acar, Y., & Fahl, S. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179378 · Cited by 21 · see citing works
Estimating the Attack Surface from Residual Vulnerabilities in Open Source Software Supply Chain
Yan, D., Niu, Y., Liu, K., Liu, Z., Liu, Z., & Bissyandé, T. F. (2021) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs54544.2021.00060 · Cited by 20 · see citing works
On business adoption and use of reproducible builds for open and closed source software
Butler, S., Gamalielsson, J., Lundell, B., Brax, C., Mattsson, A., Gustavsson, T., Feist, J., Kvarnström, B., & Lönroth, E. (2022) · Software Quality Journal · doi:10.1007/s11219-022-09607-z · Cited by 20 · see citing works
Air-Gap Electromagnetic Covert Channel
Guri, M. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3300035 · Cited by 20 · see citing works
Enhancing Blockchain-Based Processes with Decentralized Oracles
Basile, D., Goretti, V., Ciccio, C. D., & Kirrane, S. (2021) · Lecture notes in business information processing · doi:10.1007/978-3-030-85867-4_8 · Cited by 19 · see citing works
Towards the Detection of Malicious Java Packages
Ladisa, P., Plate, H., Martínez, M., Barais, O., & Ponta, S. E. (2022) · doi:10.1145/3560835.3564548 · Cited by 19 · see citing works
Self-citationLeveraging Large Language Models to Detect NPM Malicious Packages
Zahan, N., Burckhardt, P., Lysenko, M., Aboukhadijeh, F., & Williams, L. A. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00146 · Cited by 18 · see citing works
A Survey on Common Threats in npm and PyPi Registries
Kaplan, B., & Qian, J. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-87839-9_6 · Cited by 18 · see citing works
What are Weak Links in the npm Supply Chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip55303.2022.9794068 · Cited by 18 · see citing works
Malicious Package Detection using Metadata Information
Halder, S., Bewong, M., Mahboubi, A., Jiang, Y., Islam, R., Islam, M. Z., Ip, R. H. L., Ahmed, M. E., Ramachandran, G. S., & Babar, M. A. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645543 · Cited by 17 · see citing works
A systematic review on security mechanisms for serverless computing
Escaleira, P., Cunha, V. A., Barraca, J. P., Gomes, D., & Aguiar, R. L. (2025) · Cluster Computing · doi:10.1007/s10586-025-05371-4 · Cited by 16 · see citing works
Malicious Packages Lurking in User-Friendly Python Package Index
Liang, G., Zhou, X., Wang, Q., Du, Y., & Huang, C. (2021) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00091 · Cited by 16 · see citing works
The Hitchhiker's Guide to Malicious Third-Party Dependencies
Ladisa, P., Şahin, M., Ponta, S. E., Rosa, M., Martínez, M., & Barais, O. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3605770.3625212 · Cited by 15 · see citing works
Differential Static Analysis for Detecting Malicious Updates to Open Source Packages
Froh, F. N., Gobbi, M. F., & Kinder, J. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3605770.3625211 · Cited by 14 · see citing works
Pöhn, D., Grabatin, M., & Hommel, W. (2023) · Applied Sciences · doi:10.3390/app14010139 · Cited by 14 · see citing works
Trojan Source: Invisible VulnerabilitiesPreprint
Boucher, N., & Anderson, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.00169 · Cited by 14 · see citing works
Klivan, S., Höltervennhoff, S., Panskus, R., Marky, K., & Fahl, S. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00214 · Cited by 13 · see citing works
Towards build verifiability for Java-based systems
Xiong, J., Shi, Y., Chen, B., Cogo, F. R., & Jiang, Z. M. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513050 · Cited by 12 · see citing works
Huang, Y., Wang, R., Zheng, W. H., Zhou, Z., Wu, S., Ke, S., Chen, B., Gao, S., & Peng, X. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695492 · Cited by 13 · see citing works
Automatically Generating Rules of Malicious Software Packages via Large Language Model
Zhang, X., Du, X., Chen, H., He, Y., Niu, W., & Li, Y. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00072 · Cited by 12 · see citing works
Journey to the Center of Software Supply Chain Attacks
Ladisa, P., Ponta, S. E., Sabetta, A., Martínez, M., & Barais, O. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3302066 · Cited by 11 · see citing works
MalPacDetector: An LLM-Based Malicious NPM Package Detector
Wang, J., Li, Z., Qu, J., Zou, D., Xu, S., Xu, Z., Wang, Z., & Jin, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3580336 · Cited by 11 · see citing works
A Taxonomy for Threat Actors’ Delivery Techniques
Villalón-Huerta, A., Ripoll, I., & Marco-Gisbert, H. (2022) · Applied Sciences · doi:10.3390/app12083929 · Cited by 11 · see citing works
Blockchain-Based Zero Trust Supply Chain Security Integrated with Deep Reinforcement LearningPreprint
Ismail, S. S., Moudoud, H., Dawoud, D. W., & Reza, H. (2024) · Preprints.org · doi:10.20944/preprints202403.0714.v1 · Cited by 11 · see citing works
Unreproducible builds: time to fix, causes, and correlation with external ecosystem factors
Bajaj, R., Fernandes, E., Adams, B., & Hassan, A. E. (2023) · Empirical Software Engineering · doi:10.1007/s10664-023-10399-4 · Cited by 10 · see citing works
AROMA: Automatic Reproduction of Maven Artifacts
Keshani, M., Velican, T.-G., Bot, G., & Proksch, S. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643764 · Cited by 10 · see citing works
Software supply chain security: a systematic literature review
Reichert, B. M., & Obelheiro, R. R. (2024) · International Journal of Computers and Applications · doi:10.1080/1206212x.2024.2390978 · Cited by 13 · see citing works
Vulnerability management in Linux distributions
Lin, J., Zhang, H., Adams, B., & Hassan, A. E. (2023) · Empirical Software Engineering · doi:10.1007/s10664-022-10267-7 · Cited by 10 · see citing works
He, H., Vasilescu, B., & Kästner, C. (2025) · Proceedings of the ACM on software engineering. · doi:10.1145/3715728 · Cited by 10 · see citing works
Construction of Software Supply Chain Threat Portrait Based on Chain Perspective
Wang, M., Wu, P., & Luo, Q. (2023) · Mathematics · doi:10.3390/math11234856 · Cited by 9 · see citing works
Warren, B. E., Bilbily, A., Gichoya, J. W., Chartier, L. B., Fawzy, A., Barragán, C., Jaberi, A., & Mafeld, S. C. (2024) · Canadian Association of Radiologists Journal · doi:10.1177/08465371241236377 · Cited by 9 · see citing works
C2-Eye: framework for detecting command and control (C2) connection of supply chain attacks
Haider, R. Z., Aslam, B., Abbas, H., & Iqbal, Z. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00850-y · Cited by 8 · see citing works
A scoping study: crime and connected and autonomous vehicles
Brown, A., Johnson, S. D., & Tuptuk, N. (2025) · Crime Science · doi:10.1186/s40163-025-00245-x · Cited by 8 · see citing works
Malicious source code detection using a translation model
Tsfaty, C., & Fire, M. (2023) · Patterns · doi:10.1016/j.patter.2023.100773 · Cited by 14 · see citing works
MalwareBench: Malware samples are not enough
Zahan, N., Burckhardt, P., Lysenko, M., Aboukhadijeh, F., & Williams, L. A. (2024) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3643991.3644883 · Cited by 8 · see citing works
UntrustIDE: Exploiting Weaknesses in VS Code Extensions
Lin, E., Koishybayev, I., Dunlap, T., Enck, W., & Kapravelos, A. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24073 · Cited by 7 · see citing works
RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains
Sofaer, R. J., David, Y., Kang, M., Yu, J., Cao, Y., Yang, J., & Nieh, J. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3639199 · Cited by 7 · see citing works
Dependabot and security pull requests: large empirical study
Rebatchi, H., Bissyandé, T. F., & Moha, N. (2024) · Empirical Software Engineering · doi:10.1007/s10664-024-10523-y · Cited by 7 · see citing works
Software Supply Chain Risk Assessment Framework
Zahan, N. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion58688.2023.00068 · Cited by 7 · see citing works
SBOM Challenges for Developers: From Analysis of Stack Overflow Questions
Otoda, W., Kanda, T., Manabe, Y., Inoue, K., & Higo, Y. (2024) · IEEE/ACIS International Conference on Software Engineering Research, Management and Applications (SERA) · doi:10.1109/sera61261.2024.10685624 · Cited by 6 · see citing works
Nadgowda, S. J. (2022) · International Workshop on Container Technologies and Container Clouds (WoC) · doi:10.1145/3565384.3565889 · Cited by 6 · see citing works
Poster: Using CodeQL to Detect Malware in npm
Gobbi, M. F., & Kinder, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3624401 · Cited by 6 · see citing works
Levels of Binary Equivalence for the Comparison of Binaries from Alternative Builds
Dietrich, J. B., White, T., Hassanshahi, B., & Krishnan, P. (2025) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme64153.2025.00058 · Cited by 6 · see citing works
Byrne, A., Nadgowda, S. J., & Coskun, A. K. (2020) · International Workshop on Serverless Computing (WoSC) · doi:10.1145/3429880.3430098 · Cited by 6 · see citing works
Invisible Supply Chain Attacks Based on Trojan Source
Buchicchio, E., Grilli, L., Capobianco, E., Cipriano, S., & Antonini, D. (2022) · Computer · doi:10.1109/mc.2022.3190801 · Cited by 6 · see citing works
Supporting the Detection of Software Supply Chain Attacks through Unsupervised Signature GenerationPreprint
Ohm, M., Kempf, L., Boes, F., & Meier, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.02235 · Cited by 6 · see citing works
Self-citationNavigating vulnerability markets and bug bounty programs: A public policy perspective
Zrahia, A. (2024) · Internet Policy Review · doi:10.14763/2024.1.1740 · Cited by 6 · see citing works
Opdebeeck, R., Adams, B., & Roover, C. D. (2025) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner64311.2025.00025 · Cited by 5 · see citing works
Closing the Chain: How to reduce your risk of being SolarWinds, Log4j, or XZ Utils
Hamer, S., Bowen, J., Haque, M. N., Hines, R., Madden, C., & Williams, L. A. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773194 · Cited by 6 · see citing works
DySec: A Machine Learning-Based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem
Mehedi, S. T., Islam, C., Ramachandran, G. S., & Jurdak, R. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3654388 · Cited by 5 · see citing works
Ahmed, A., & Abdullah, A. (2024) · International Journal on Soft Computing · doi:10.5121/ijsc.2024.15201 · Cited by 5 · see citing works
OSSIntegrity: Collaborative open-source code integrity verification
Nahum, M., Grolman, E., Maimon, I., Mimran, D., Brodt, O., Elyashar, A., Elovici, Y., & Shabtai, A. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103977 · Cited by 5 · see citing works
$ZTD_{\text{JAVA}}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies
Amusuo, P. C., Robinson, K. A., Singla, T., Peng, H., Machiry, A., Torres-Arias, S., Simon, L., & Davis, J. C. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00148 · Cited by 7 · see citing works
An Analysis of Malicious Packages in Open-Source Software in the Wild
Zhou, X., Zhang, Y., Niu, W., Liu, J., Wang, H., & Li, Q. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00045 · Cited by 5 · see citing works
Current Security Threats in Applications of Wireless Sensor Network
John, A., Isnin, I. F., & Madni, S. H. H. (2023) · International Journal on Engineering Science and Technology · doi:10.46328/ijonest.174 · Cited by 5 · see citing works
Unveil the Mystery of Critical Software Vulnerabilities
Pan, S., Bao, L., Zhou, J., Hu, X., Xia, X., & Li, S. (2024) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3663529.3663835 · Cited by 5 · see citing works
Lins, M., Mayrhofer, R., & Roland, M. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-4434-9_24 · Cited by 4 · see citing works
Are Your Dependencies Code Reviewed?: Measuring Code Review Coverage in Dependency Updates
Imtiaz, N., & Williams, L. A. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3319509 · Cited by 4 · see citing works
QuADTool: Attack-Defense-Tree Synthesis, Analysis and Bridge to Verification
Dorfhuber, F., Eisentraut, C., Klioba, K., & Křetínský, J. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68416-6_4 · Cited by 4 · see citing works
Hamer, S., Imtiaz, N., Tamanna, M., Shabrina, P., & Williams, L. A. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3551664 · Cited by 4 · see citing works
Dependency Network Structure and Security Vulnerabilities in Software Supply Chains
Yoo, E., Craighead, C. W., & Samtani, S. (2025) · Journal of Management Information Systems · doi:10.1080/07421222.2025.2561385 · Cited by 4 · see citing works
The Role of BlockChain Adoption and Supply Chain Practices on Social Commerce
Thajil, K. M., Al‐Abrrow, H., & Abdullah, H. O. (2022) · Springer eBooks · doi:10.1007/978-981-19-6509-8_8 · Cited by 4 · see citing works
Connecting the .dotfiles: Checked-In Secret Exposure with Extra (Lateral Movement) Steps
Jungwirth, G., Saha, A., Schröder, M., Fiebig, T., Lindorfer, M., & Cito, J. (2023) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr59073.2023.00051 · Cited by 4 · see citing works
- Authors
- Ohm, M., Plate, H., Sykosch, A., & Meier, M.
- Affiliations
- University of Bonn (DE)
- Corresponding author
- Ohm, Marc
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2020
- Pages
- 23-43
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- PMC
- PMC7338168
- OpenAlex
- W3028285817
- Cited by
- 259
- References
- 9
- Citations by year
- 2026: 61 · 2025: 61 · 2024: 50 · 2023: 44 · 2022: 24 · 2021: 15 · 2020: 4
- FWCI
- 16.50
- Type
- conference paper
- Language
- en
- Open access
- green
- www.ncbi.nlm.nih.gov
- Locations
- Lecture notes in computer science (publishedVersion)
- PubMed Central (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft) (submittedVersion)
- Fraunhofer-Publica (Fraunhofer-Gesellschaft) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Signal Processing › Advanced Malware Detection Techniques
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- software supply chain attacks, open source software, npm, PyPI, RubyGems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
