The DOI matches its Crossref record; 8 of the 9 references it cites were found in a registry or an index.
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Open accessOverview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Also, software supply chain attacks are becoming increasingly diverse and sophisticated, evolving from simple typosquatting [72] to complex social engineering attacks as in the xz attack [11] and reputation farming [18].”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [72]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
On the impact of security vulnerabilities in the npm package dependency network
Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236
Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint
Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147
Detecting Suspicious Package Updates
Garrett, K. A., Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2019) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier.2019.00012 · Cited by 59
Identification of Dependency-based Attacks on Node.js
Pfretzschner, B., & Othmane, L. B. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3120928 · Cited by 39
Poisoning the software supply chain
Levy, E. (2003) · IEEE Security & Privacy · doi:10.1109/msecp.2003.1203227 · Cited by 34
Security of public continuous integration services
Gruhn, V., Hannebauer, C., & John, C. (2013) · International Symposium on Open Collaboration · doi:10.1145/2491055.2491070 · Cited by 24
An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications
Ruohonen, J. (2018) · International Workshop on Empirical Software Engineering in Practice (IWESEP) · doi:10.1109/iwesep.2018.00013 · Cited by 20
Security Issues in Language-based Software EcosystemsPreprint
Vaidya, R. K., Carli, L. D., Davidson, D., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.02613 · Cited by 3
Research works printed but not linked: 1
- Tschacher, N.P.: Typosquatting in programming language package managers. Master’s thesis, Universität Hamburg, Fachbereich Informatik (2016)
Cited by
Sorted by citations
Evaluating Large Language Models Trained on Code
Chen, M., Tworek, J., Jun, H., Yuan, Q., Pinto, H. P. D. O., Kaplan, J., Edwards, H., Burda, Y., Joseph, N., Brockman, G., et al. (2021) · arXiv · doi:10.48550/arxiv.2107.03374 · Cited by 1,436
“20 Also worrying is the possibility of Codex suggesting malicious or typosquatted packages (Ohm et al., 2020).”
BackgroundSoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Ladisa, P., Plate, H., Martinez, M., & Barais, O. (2023) · 2023 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46215.2023.10179304 · Cited by 208
Self-citationWhat are weak links in the npm supply chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513044 · Cited by 104
An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead
Xia, B., Bi, T., Xing, Z., Lu, Q., & Zhu, L. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00219 · Cited by 101
Reproducible Builds: Increasing the Integrity of Software Supply Chains
Lamb, C., & Zacchiroli, S. (2021) · IEEE Software · doi:10.1109/ms.2021.3073045 · Cited by 90
Practical automated detection of malicious npm packages
Sejfia, A., & Schäfer, M. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510104 · Cited by 86
On the impact of security vulnerabilities in the npm and RubyGems dependency networks
Zerouali, A., Mens, T., Decan, A., & Roover, C. D. (2022) · Empirical Software Engineering · doi:10.1007/s10664-022-10154-1 · Cited by 69
Stalnaker, T., Wintersgill, N., Chaparro, O., Penta, M. D., Germán, D. M., & Poshyvanyk, D. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3623347 · Cited by 66
Cybersecurity and Forensics in Connected Autonomous Vehicles: A Review of the State-of-the-Art
Sharma, P., & Gillanders, J. (2022) · IEEE Access · doi:10.1109/access.2022.3213843 · Cited by 61
Towards detection of software supply chain attacks by forensic artifacts
Ohm, M., Sykosch, A., & Meier, M. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3409183 · Cited by 58
Self-citationAnomalicious: Automated Detection of Anomalous and Potentially Malicious Commits on GitHub
Gonzalez, D., Zimmermann, T., Godefroid, P., & Schaefer, M. (2021) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00035 · Cited by 59
SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties
Okafor, C., Schorlemmer, T. R., Torres-Arias, S., & Davis, J. C. (2022) · doi:10.1145/3560835.3564556 · Cited by 56
LastPyMile: identifying the discrepancy between sources and packages
Vu, D., Massacci, F., Николаевич, П. И., Plate, H., & Sabetta, A. (2021) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3468264.3468592 · Cited by 56
Self-citationAn Empirical Study of Malicious Code In PyPI Ecosystem
Guo, W., Xu, Z., Liu, C., Huang, C., Fang, Y., & Liu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00135 · Cited by 53
Analysis of security and privacy challenges for DNA-genomics applications and databases
Arshad, S., Arshad, J., Khan, M. M., & Parkinson, S. (2021) · Journal of Biomedical Informatics · doi:10.1016/j.jbi.2021.103815 · Cited by 55
Teichmann, F. M. J., Boticiu, S. R., & Sergi, B. S. (2023) · International Cybersecurity Law Review · doi:10.1365/s43439-023-00095-w · Cited by 46
Online Banking User Authentication Methods: A Systematic Literature Review
Karim, N. A., Khashan, O. A., Kanaker, H., Abdulraheem, W. K., Alshinwan, M., & Al-Banna, A.-K. (2023) · IEEE Access · doi:10.1109/access.2023.3346045 · Cited by 45
Wani, M. S., Kretschmer, M., Schröder, B., Grebe, A., & Rademacher, M. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3430823 · Cited by 44
On the Feasibility of Supervised Machine Learning for the Detection of Malicious Software Packages
Ohm, M., Boes, F., Bungartz, C., & Meier, M. (2022) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3538969.3544415 · Cited by 35
Self-citationHamer, S., d’Amorim, M., & Williams, L. A. (2024) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw63631.2024.00014 · Cited by 52
Maltracker: A Fine-Grained NPM Malware Tracker Copiloted by LLM-Enhanced Dataset
Yu, Z., Wen, M., Guo, X., & Jin, H. (2024) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3650212.3680397 · Cited by 42
On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI
Ladisa, P., Ponta, S. E., Ronzoni, N., Martínez, M., & Barais, O. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627138 · Cited by 30
Ismail, S. S., Dandan, S., Dawoud, D. W., & Reza, H. (2024) · IEEE Access · doi:10.1109/access.2024.3432454 · Cited by 29
Software Bill of Materials Adoption: A Mining Study from GitHub
Nocera, S., Romano, S., Penta, M. D., Francese, R., & Scanniello, G. (2023) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme58846.2023.00016 · Cited by 28
On the feasibility of detecting injections in malicious npm packages
Scalco, S., Paramitha, R., Vu, D., & Massacci, F. (2022) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3538969.3543815 · Cited by 27
An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures
Singla, T., Anandayuvaraj, D., Kalu, K. G., Schorlemmer, T. R., & Davis, J. C. (2023) · Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses · doi:10.1145/3605770.3625214 · Cited by 26
On the Correctness of Metadata-Based SBOM Generation: A Differential Analysis Approach
Yu, S., Song, W., Hu, X., & Yin, H. (2024) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn58291.2024.00018 · Cited by 26
Bad Snakes: Understanding and Improving Python Package Index Malware Scanning
Vu, D., Newman, Z., & Meyers, J. S. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00052 · Cited by 25
Zhang, J., Wu, P., London, J., & Tenney, D. (2025) · IEEE Access · doi:10.1109/access.2025.3540075 · Cited by 30
Investigating Package Related Security Threats in Software Registries
Gu, Y., Ying, L., Pu, Y., Hu, X., Chai, H., Wang, R., Gao, X. H., & Duan, H. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179332 · Cited by 24
Jôrgensen, B. N., & Ma, Z. G. (2026) · Applied Sciences · doi:10.3390/app16020981 · Cited by 29
Automated unearthing of dangerous issue reports
Pan, S., Zhou, J., Cogo, F. R., Xia, X., Bao, L., Hu, X., Li, S., & Hassan, A. E. (2022) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3540250.3549156 · Cited by 23
Li, N., Wang, S., Feng, M., Wang, K., Wang, M., & Wang, H. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00073 · Cited by 23
Reusing Deep Learning Models: Challenges and Directions in Software Engineering
Davis, J. C., Jajal, P., Jiang, W., Schorlemmer, T. R., Synovic, N. M., & Thiruvathukal, G. K. (2023) · IEEE John Vincent Atanasoff International Symposium on Modern Computing (JVA) · doi:10.1109/jva60410.2023.00015 · Cited by 26
A Needle is an Outlier in a Haystack: Hunting Malicious PyPI Packages with Code Clustering
Liang, W., Ling, X. G., Wu, J., Luo, T., & Wu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00085 · Cited by 22
Evolving collaboration, dependencies, and use in the Rust Open Source Software ecosystem
Schueller, W., Wachs, J., Servedio, V. D. P., Stefan Thurner, A., & Loreto, V. (2022) · Scientific Data · doi:10.1038/s41597-022-01819-z · Cited by 25
On the prevalence of software supply chain attacks: Empirical study and investigative framework
Andreoli, A., Lounis, A., Debbabi, M., & Hanna, A. (2023) · Forensic Science International Digital Investigation · doi:10.1016/j.fsidi.2023.301508 · Cited by 21
"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain
Wermke, D., Klemmer, J. H., Wöhler, N., Schmüser, J., Ramulu, H. S., Acar, Y., & Fahl, S. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179378 · Cited by 21
Estimating the Attack Surface from Residual Vulnerabilities in Open Source Software Supply Chain
Yan, D., Niu, Y., Liu, K., Liu, Z., Liu, Z., & Bissyandé, T. F. (2021) · IEEE International Conference on Software Quality, Reliability and Security (QRS) · doi:10.1109/qrs54544.2021.00060 · Cited by 20
On business adoption and use of reproducible builds for open and closed source software
Butler, S., Gamalielsson, J., Lundell, B., Brax, C., Mattsson, A., Gustavsson, T., Feist, J., Kvarnström, B., & Lönroth, E. (2022) · Software Quality Journal · doi:10.1007/s11219-022-09607-z · Cited by 20
Air-Gap Electromagnetic Covert Channel
Guri, M. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3300035 · Cited by 20
Enhancing Blockchain-Based Processes with Decentralized Oracles
Basile, D., Goretti, V., Ciccio, C. D., & Kirrane, S. (2021) · Lecture notes in business information processing · doi:10.1007/978-3-030-85867-4_8 · Cited by 19
Towards the Detection of Malicious Java Packages
Ladisa, P., Plate, H., Martínez, M., Barais, O., & Ponta, S. E. (2022) · doi:10.1145/3560835.3564548 · Cited by 19
Self-citationLeveraging Large Language Models to Detect NPM Malicious Packages
Zahan, N., Burckhardt, P., Lysenko, M., Aboukhadijeh, F., & Williams, L. A. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00146 · Cited by 45
A Survey on Common Threats in npm and PyPi Registries
Kaplan, B., & Qian, J. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-87839-9_6 · Cited by 18
What are Weak Links in the npm Supply Chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip55303.2022.9794068 · Cited by 18
Malicious Package Detection using Metadata Information
Halder, S., Bewong, M., Mahboubi, A., Jiang, Y., Islam, R., Islam, M. Z., Ip, R. H. L., Ahmed, M. E., Ramachandran, G. S., & Babar, M. A. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645543 · Cited by 17
A systematic review on security mechanisms for serverless computing
Escaleira, P., Cunha, V. A., Barraca, J. P., Gomes, D., & Aguiar, R. L. (2025) · Cluster Computing · doi:10.1007/s10586-025-05371-4 · Cited by 16
Malicious Packages Lurking in User-Friendly Python Package Index
Liang, G., Zhou, X., Wang, Q., Du, Y., & Huang, C. (2021) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom53373.2021.00091 · Cited by 16
The Hitchhiker's Guide to Malicious Third-Party Dependencies
Ladisa, P., Şahin, M., Ponta, S. E., Rosa, M., Martínez, M., & Barais, O. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3605770.3625212 · Cited by 15
Differential Static Analysis for Detecting Malicious Updates to Open Source Packages
Froh, F. N., Gobbi, M. F., & Kinder, J. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3605770.3625211 · Cited by 14
Pöhn, D., Grabatin, M., & Hommel, W. (2023) · Applied Sciences · doi:10.3390/app14010139 · Cited by 14
Trojan Source: Invisible VulnerabilitiesPreprint
Boucher, N., & Anderson, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.00169 · Cited by 14
Klivan, S., Höltervennhoff, S., Panskus, R., Marky, K., & Fahl, S. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00214 · Cited by 13
Towards build verifiability for Java-based systems
Xiong, J., Shi, Y., Chen, B., Cogo, F. R., & Jiang, Z. M. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513050 · Cited by 12
Huang, Y., Wang, R., Zheng, W. H., Zhou, Z., Wu, S., Ke, S., Chen, B., Gao, S., & Peng, X. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695492 · Cited by 13
Automatically Generating Rules of Malicious Software Packages via Large Language Model
Zhang, X., Du, X., Chen, H., He, Y., Niu, W., & Li, Y. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00072 · Cited by 12
Journey to the Center of Software Supply Chain Attacks
Ladisa, P., Ponta, S. E., Sabetta, A., Martínez, M., & Barais, O. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3302066 · Cited by 11
MalPacDetector: An LLM-Based Malicious NPM Package Detector
Wang, J., Li, Z., Qu, J., Zou, D., Xu, S., Xu, Z., Wang, Z., & Jin, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3580336 · Cited by 11
A Taxonomy for Threat Actors’ Delivery Techniques
Villalón-Huerta, A., Ripoll, I., & Marco-Gisbert, H. (2022) · Applied Sciences · doi:10.3390/app12083929 · Cited by 11
Blockchain-Based Zero Trust Supply Chain Security Integrated with Deep Reinforcement LearningPreprint
Ismail, S. S., Moudoud, H., Dawoud, D. W., & Reza, H. (2024) · Preprints.org · doi:10.20944/preprints202403.0714.v1 · Cited by 11
Unreproducible builds: time to fix, causes, and correlation with external ecosystem factors
Bajaj, R., Fernandes, E., Adams, B., & Hassan, A. E. (2023) · Empirical Software Engineering · doi:10.1007/s10664-023-10399-4 · Cited by 10
AROMA: Automatic Reproduction of Maven Artifacts
Keshani, M., Velican, T.-G., Bot, G., & Proksch, S. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643764 · Cited by 10
Software supply chain security: a systematic literature review
Reichert, B. M., & Obelheiro, R. R. (2024) · International Journal of Computers and Applications · doi:10.1080/1206212x.2024.2390978 · Cited by 13
Vulnerability management in Linux distributions
Lin, J., Zhang, H., Adams, B., & Hassan, A. E. (2023) · Empirical Software Engineering · doi:10.1007/s10664-022-10267-7 · Cited by 10
He, H., Vasilescu, B., & Kästner, C. (2025) · Proceedings of the ACM on software engineering. · doi:10.1145/3715728 · Cited by 10
Construction of Software Supply Chain Threat Portrait Based on Chain Perspective
Wang, M., Wu, P., & Luo, Q. (2023) · Mathematics · doi:10.3390/math11234856 · Cited by 9
Warren, B. E., Bilbily, A., Gichoya, J. W., Chartier, L. B., Fawzy, A., Barragán, C., Jaberi, A., & Mafeld, S. C. (2024) · Canadian Association of Radiologists Journal · doi:10.1177/08465371241236377 · Cited by 9
C2-Eye: framework for detecting command and control (C2) connection of supply chain attacks
Haider, R. Z., Aslam, B., Abbas, H., & Iqbal, Z. (2024) · International Journal of Information Security · doi:10.1007/s10207-024-00850-y · Cited by 8
A scoping study: crime and connected and autonomous vehicles
Brown, A., Johnson, S. D., & Tuptuk, N. (2025) · Crime Science · doi:10.1186/s40163-025-00245-x · Cited by 8
Malicious source code detection using a translation model
Tsfaty, C., & Fire, M. (2023) · Patterns · doi:10.1016/j.patter.2023.100773 · Cited by 20
MalwareBench: Malware samples are not enough
Zahan, N., Burckhardt, P., Lysenko, M., Aboukhadijeh, F., & Williams, L. A. (2024) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3643991.3644883 · Cited by 8
UntrustIDE: Exploiting Weaknesses in VS Code Extensions
Lin, E., Koishybayev, I., Dunlap, T., Enck, W., & Kapravelos, A. (2024) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2024.24073 · Cited by 7
RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains
Sofaer, R. J., David, Y., Kang, M., Yu, J., Cao, Y., Yang, J., & Nieh, J. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3639199 · Cited by 7
Dependabot and security pull requests: large empirical study
Rebatchi, H., Bissyandé, T. F., & Moha, N. (2024) · Empirical Software Engineering · doi:10.1007/s10664-024-10523-y · Cited by 7
Software Supply Chain Risk Assessment Framework
Zahan, N. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion58688.2023.00068 · Cited by 7
SBOM Challenges for Developers: From Analysis of Stack Overflow Questions
Otoda, W., Kanda, T., Manabe, Y., Inoue, K., & Higo, Y. (2024) · IEEE/ACIS International Conference on Software Engineering Research, Management and Applications (SERA) · doi:10.1109/sera61261.2024.10685624 · Cited by 6
Nadgowda, S. J. (2022) · International Workshop on Container Technologies and Container Clouds (WoC) · doi:10.1145/3565384.3565889 · Cited by 6
Poster: Using CodeQL to Detect Malware in npm
Gobbi, M. F., & Kinder, J. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3624401 · Cited by 6
Levels of Binary Equivalence for the Comparison of Binaries from Alternative Builds
Dietrich, J. B., White, T., Hassanshahi, B., & Krishnan, P. (2025) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme64153.2025.00058 · Cited by 6
Byrne, A., Nadgowda, S. J., & Coskun, A. K. (2020) · International Workshop on Serverless Computing (WoSC) · doi:10.1145/3429880.3430098 · Cited by 6
Invisible Supply Chain Attacks Based on Trojan Source
Buchicchio, E., Grilli, L., Capobianco, E., Cipriano, S., & Antonini, D. (2022) · Computer · doi:10.1109/mc.2022.3190801 · Cited by 6
Supporting the Detection of Software Supply Chain Attacks through Unsupervised Signature GenerationPreprint
Ohm, M., Kempf, L., Boes, F., & Meier, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.02235 · Cited by 6
Self-citationNavigating vulnerability markets and bug bounty programs: A public policy perspective
Zrahia, A. (2024) · Internet Policy Review · doi:10.14763/2024.1.1740 · Cited by 6
Opdebeeck, R., Adams, B., & Roover, C. D. (2025) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner64311.2025.00025 · Cited by 5
Closing the Chain: How to reduce your risk of being SolarWinds, Log4j, or XZ Utils
Hamer, S., Bowen, J., Haque, M. N., Hines, R., Madden, C., & Williams, L. A. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773194 · Cited by 6
DySec: A Machine Learning-Based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem
Mehedi, S. T., Islam, C., Ramachandran, G. S., & Jurdak, R. (2026) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2026.3654388 · Cited by 5
Ahmed, A., & Abdullah, A. (2024) · International Journal on Soft Computing · doi:10.5121/ijsc.2024.15201 · Cited by 5
OSSIntegrity: Collaborative open-source code integrity verification
Nahum, M., Grolman, E., Maimon, I., Mimran, D., Brodt, O., Elyashar, A., Elovici, Y., & Shabtai, A. (2024) · Computers & Security · doi:10.1016/j.cose.2024.103977 · Cited by 5
$ZTD_{\text{JAVA}}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies
Amusuo, P. C., Robinson, K. A., Singla, T., Peng, H., Machiry, A., Torres-Arias, S., Simon, L., & Davis, J. C. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00148 · Cited by 7
An Analysis of Malicious Packages in Open-Source Software in the Wild
Zhou, X., Zhang, Y., Niu, W., Liu, J., Wang, H., & Li, Q. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00045 · Cited by 5
Current Security Threats in Applications of Wireless Sensor Network
John, A., Isnin, I. F., & Madni, S. H. H. (2023) · International Journal on Engineering Science and Technology · doi:10.46328/ijonest.174 · Cited by 5
Unveil the Mystery of Critical Software Vulnerabilities
Pan, S., Bao, L., Zhou, J., Hu, X., Xia, X., & Li, S. (2024) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3663529.3663835 · Cited by 5
Lins, M., Mayrhofer, R., & Roland, M. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-4434-9_24 · Cited by 4
Are Your Dependencies Code Reviewed?: Measuring Code Review Coverage in Dependency Updates
Imtiaz, N., & Williams, L. A. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3319509 · Cited by 4
QuADTool: Attack-Defense-Tree Synthesis, Analysis and Bridge to Verification
Dorfhuber, F., Eisentraut, C., Klioba, K., & Křetínský, J. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-68416-6_4 · Cited by 4
Hamer, S., Imtiaz, N., Tamanna, M., Shabrina, P., & Williams, L. A. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3551664 · Cited by 4
Dependency Network Structure and Security Vulnerabilities in Software Supply Chains
Yoo, E., Craighead, C. W., & Samtani, S. (2025) · Journal of Management Information Systems · doi:10.1080/07421222.2025.2561385 · Cited by 4
The Role of BlockChain Adoption and Supply Chain Practices on Social Commerce
Thajil, K. M., Al‐Abrrow, H., & Abdullah, H. O. (2022) · Springer eBooks · doi:10.1007/978-981-19-6509-8_8 · Cited by 4
Connecting the .dotfiles: Checked-In Secret Exposure with Extra (Lateral Movement) Steps
Jungwirth, G., Saha, A., Schröder, M., Fiebig, T., Lindorfer, M., & Cito, J. (2023) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr59073.2023.00051 · Cited by 4
Metadata
- Authors
- Ohm, M., Plate, H., Sykosch, A., & Meier, M.
- Affiliations
- University of Bonn (DE)
- Corresponding author
- Ohm, Marc
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2020
- Pages
- 23-43
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- PMC
- PMC7338168
- OpenAlex
- W3028285817
- Cited by
- 259
- References
- 9
- Citations by year
- 2026: 61 · 2025: 61 · 2024: 50 · 2023: 44 · 2022: 24 · 2021: 15 · 2020: 4
- FWCI
- 16.50
- Type
- conference paper
- Language
- en
- Open access
- green
- www.ncbi.nlm.nih.gov
- Locations
- Lecture notes in computer science (publishedVersion)
- PubMed Central (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft) (submittedVersion)
- Fraunhofer-Publica (Fraunhofer-Gesellschaft) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Software › Advanced Malware Detection Techniques
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- software supply chain attacks, open source software, npm, PyPI, RubyGems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
