Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks

On the impact of security vulnerabilities in the npm package dependency network

Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236

Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint

Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147

Detecting Suspicious Package Updates

Garrett, K. A., Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2019) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier.2019.00012 · Cited by 59

Identification of Dependency-based Attacks on Node.js

Pfretzschner, B., & Othmane, L. B. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3120928 · Cited by 39

Poisoning the software supply chain

Levy, E. (2003) · IEEE Security & Privacy · doi:10.1109/msecp.2003.1203227 · Cited by 34

Security of public continuous integration services

Gruhn, V., Hannebauer, C., & John, C. (2013) · International Symposium on Open Collaboration · doi:10.1145/2491055.2491070 · Cited by 24

An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications

Ruohonen, J. (2018) · International Workshop on Empirical Software Engineering in Practice (IWESEP) · doi:10.1109/iwesep.2018.00013 · Cited by 20

Security Issues in Language-based Software EcosystemsPreprint

Vaidya, R. K., Carli, L. D., Davidson, D., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.02613 · Cited by 3

EL-GRILLO: Leaking Data Ultrasonically from Air-Gapped PCs via the Tiny Motherboard Buzzer

Guri, M. (2023) · Conference on Privacy, Security and Trust · doi:10.1109/pst58708.2023.10319985 · Cited by 4

A Method and Platform for Security Advisory Dissemination Leveraging Web3 Technologies

Sommer, J. L., Lund, M. M., Cibin, N., & Albano, M. (2023) · IEEE International Conference on Blockchain (Blockchain) · doi:10.1109/blockchain60715.2023.00050 · Cited by 4

Developer reactions to protestware in open source software: the cases of color.js and es5.ext

Fan, Y., Wang, D., Wattanakriengkrai, S., Damrongsiri, H., Treude, C., Hata, H., & Kula, R. G. (2025) · Empirical Software Engineering · doi:10.1007/s10664-024-10599-6 · Cited by 4

Detecting Python Malware in the Software Supply Chain with Program Analysis

Shariffdeen, R., Hassanshahi, B., Мирчев, М., Husseini, A. E., & Roychoudhury, A. (2025) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip66354.2025.00024 · Cited by 4

“I see models being a whole other thing”: an empirical study of pre-trained model naming conventions and a tool for enhancing naming consistency

Jiang, W., Kim, M., Cheung, C., Kim, H., Thiruvathukal, G. K., & Davis, J. C. (2025) · Empirical Software Engineering · doi:10.1007/s10664-025-10711-4 · Cited by 25

Simple stupid insecure practices and GitHub’s code search: A looming threat?

Go, K. R., Soundarapandian, S., Mitra, A., Vidoni, M. C., & Ferreyra, N. E. D. (2023) · Journal of Systems and Software · doi:10.1016/j.jss.2023.111698 · Cited by 4

Automatic Diversity in the Software Supply ChainPreprint

Harrand, N., Durieux, T., Broman, D., & Baudry, B. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.03154 · Cited by 4

Eradicating the Unseen: Detecting, Exploiting, and Remediating a Path Traversal Vulnerability across GitHub

Akhoundali, J., Hamidi, H., Rietveld, K. F. D., & Gadyatskaya, O. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3736220 · Cited by 3

Wolf in Sheep’s Clothing: Shearing the Camouflage of Malicious Java Components in Maven

Zeng, Y., Huang, C., Han, J., Zhao, J., Wang, N., Liang, G., & Jiang, S. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3599732 · Cited by 3

Securing the Software Supply Chain with Software Bill of Materials (SBOMs): An Empirical Evaluation of Open-Source Tools in Enterprise IT Environments

Sorocean, O., Portillo‐Dominguez, A. O., & Ayala-Rivera, V. (2025) · Programming and Computer Software · doi:10.1134/s0361768825700598 · Cited by 3

Advancing cybersecurity in ASEAN: current trends, emerging challenges, and opportunities for enhanced resilience

Ali, A. S., Zaaba, Z. F., Singh, M. M., Anuar, N. B., & Shariff, M. R. B. M. (2025) · International Journal of Information Security · doi:10.1007/s10207-025-01111-2 · Cited by 8

Die Rolle von Open Source in der Silicon Economy

Schmidt, M., Culotta, C., Nettsträter, A., & Duparc, E. (2022) · Springer eBooks · doi:10.1007/978-3-662-63956-6_2 · Cited by 3

A method for identifying references between projects in GitHub

Liu, B., Zhang, L., Jiang, J., & Wang, L. (2022) · Science of Computer Programming · doi:10.1016/j.scico.2022.102858 · Cited by 3

Automatically Generate Malware Detection Rules By Extracting Risk Information

Li, H., & Li, J. (2024) · International Conference on Computing, Networks and Internet of Things (CNIOT) · doi:10.1145/3670105.3670209 · Cited by 3

CrossCode2Vec: A unified representation across source and binary functions for code similarity detection

Yu, G., An, J., Lyu, J., Huang, W., Fan, W., Cheng, Y., & Sui, A. (2024) · Neurocomputing · doi:10.1016/j.neucom.2024.129238 · Cited by 3

Experimental Setup for Grid Control Device Software Updates in Supply Chain Cyber-Security

Keller, J., Paul, S., Grijalva, S., & Mooney, V. J., III (2022) · North American Power Symposium (NAPS) · doi:10.1109/naps56150.2022.10012179 · Cited by 3

tapiserí

Nadgowda, S. J., & Luan, L. Z. (2021) · International Workshop on Container Technologies and Container Clouds (WoC) · doi:10.1145/3493649.3493655 · Cited by 3

Security Review of Ethereum Beacon ClientsPreprint

Aumasson, J.-P., Kolegov, D., & Stathopoulou, E. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2109.11677 · Cited by 3

Leveraging Large Language Models to Detect npm Malicious Packages

Zahan, N., Burckhardt, P., Lysenko, M., Aboukhadijeh, F., & Williams, L. (2024) · arXiv · doi:10.48550/arxiv.2403.12196 · Cited by 3

Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware

He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 28

A Machine Learning-Based Approach For Detecting Malicious PyPI Packages

Sammaneh, H., Costa, D. E., Shihab, E., & Abdellatif, A. (2025) · ACM Symposium on Applied Computing · doi:10.1145/3672608.3707756 · Cited by 2

SIT: An Accurate, Compliant SBOM Generator with Incremental Construction

Jia, C.-Y., Li, N., Yang, K., & Zhou, M. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion66252.2025.00013 · Cited by 2

PuRe Defender: A Game-Theoretic Pull Request Assignment with Deep RL

Koushyar, J. M., Guirguis, M., & Atia, G. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-08064-6_10 · Cited by 2

Tokenized Peer Review: An Adaptive Blockchain Mechanism for Open Source Supply Chains

Martins, I. C., Ranieri, C. M., Garcia, R. D., de Miranda, L. M. B., Maeda, L. M., Almeida, J. P. A., Ramachandran, G. S., & Ueyama, J. (2025) · Journal of Network and Systems Management · doi:10.1007/s10922-025-10004-7 · Cited by 2

Supply Chain Threats in the MCP Ecosystem: Attack Vectors and Mitigation Strategies

Lee, Y., Choi, W., & Nam, D. (2025) · Lecture notes in computer science · doi:10.1007/978-981-95-4674-9_17 · Cited by 5

Unlocking Reproducibility: Automating re-Build Process for Open-Source Software

Hassanshahi, B., Mai, T. N., Smith, B. S., & Allen, N. A. (2025) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase63991.2025.00280 · Cited by 2

VulFinder: A Multi‐Agent‐Driven Test Generation Framework for Guiding Vulnerability Reachability Analysis

Zhao, Y., Zhou, Y., Xie, J., Huang, Z., & Gong, L. (2026) · IET Software · doi:10.1049/sfw2/6602283 · Cited by 2

Coordinated cyber attacks on smart grids considering software supply chains

Kuroptev, K., & Steinke, F. (2023) · IEEE PES Innovative Smart Grid Technologies Europe · doi:10.1109/isgteurope56780.2023.10407630 · Cited by 2

Increasing trust in the open source supply chain with reproducible builds and functional package management

Malka, J. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3639478.3639806 · Cited by 2

Human Factors in Cybersecurity

Ayyad, W. R., Al-Haija, Q. S. A., & Al‐Masri, H. M. K. (2024) · Advances in information security, privacy, and ethics book series · doi:10.4018/979-8-3693-3451-5.ch011 · Cited by 2

Position: On Potential Malware & New Attack Vectors for Internet-of-Brains (IoB)

Lahtinen, T., Costin, A., & Suárez‐Tangil, G. (2024) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw61312.2024.00066 · Cited by 2

Process Identity-Based Firewalling

Mantu, R., Chiroiu, M., & Raiciu, C. (2024) · Lecture notes in computer science · doi:10.1007/978-3-031-70890-9_11 · Cited by 2

Domain-Specific Modeling Language for Security Analysis of EV Charging Infrastructure

Motii, A., Hamlaoui, M. E., & Basmadjian, R. (2024) · Energies · doi:10.3390/en17235832 · Cited by 2

PypiGuard: A novel meta-learning approach for enhanced malicious package detection in PyPI through static-dynamic feature fusion

Iqbal, T., Wu, G., Iqbal, Z., Mahmood, M. B., Shafique, A., & Guo, W. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104032 · Cited by 2

Covariate Software Vulnerability Discovery Model to Support Cybersecurity Test & Evaluation (Practical Experience Report)

Sorrentino, J., Silva, P. M. D. C., Baye, G., Kul, G., & Fiondella, L. (2022) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre55969.2022.00025 · Cited by 2

Enabling Security-Oriented Orchestration of MicroservicesPreprint

Melara, M. S., & Bowman, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.09841 · Cited by 2

A Benchmark Comparison of Python Malware Detection ApproachesPreprint

Vu, D., Newman, Z., & Meyers, J. S. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2209.13288 · Cited by 2

Securing the Software Supply Chain: A New Taxonomy for Attack Classification

Thabet, K., Bennaceur, J., Hamza, S., Djemaa, R. B., & Zouaghi, W. (2023) · IEEE International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE) · doi:10.1109/wetice57085.2023.10477812 · Cited by 1

Who's Pushing the Code? An Exploration of GitHub Impersonation

Zhang, Y., Liang, A., Wang, X., Wiśniewski, P., Zhang, F., Leach, K., & Huang, Y. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00065 · Cited by 1

Advanced code slicing with pre-trained model fine-tuned for open-source component malware detection

Wang, Y., Pang, S., Fan, Z., Shang, S., Yao, Y., Jiang, Z., & Liu, B. (2025) · The Computer Journal · doi:10.1093/comjnl/bxaf029 · Cited by 1

Detecting Malicious Packages in PyPI and NPM by Clustering Installation Scripts

Liang, W., Ling, X., Zhao, C., Wu, J., Luo, T., & Wu, Y. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3618952 · Cited by 1

Synthetic Malware at Scale: Malicious Code Generation With Code Transplanting

Wang, G., Chen, D., Gu, X., Chen, Y., & Shen, B. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3633280 · Cited by 1

Software Supply Chain Security of Web3

Monperrus, M. (2025) · Asia-Pacific Software Engineering Conference (APSEC) · doi:10.1109/apsec66846.2025.00012 · Cited by 1

Sleeping Giants - Activating Dormant Java Deserialization Gadget Chains through Stealthy Code Changes

Kreyssig, B., Houy, S., Riom, T., & Bartel, A. (2025) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3719027.3765031 · Cited by 1

CHASE: LLM Agents for Dissecting Malicious PyPI Packages

Toda, T., & Mori, T. (2025) · ACM International Conference on AI-Powered Software (AIware) · doi:10.1109/aiware69974.2025.00008 · Cited by 2

ProfMal: Detecting Malicious NPM Packages by the Synergy between Static and Dynamic Analysis

Huang, Y., Zheng, W., Wu, S., Chen, B., Lu, Y. J., Zhou, Z., Cao, Y., Li, X., & Peng, X. (2025) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase63991.2025.00042 · Cited by 1

Altered Histories in Version Control System Repositories: Evidence from the Trenches

Rapaport, S., Pautet, L., Tardieu, S., & Zacchiroli, S. (2025) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase63991.2025.00181 · Cited by 1

Evaluating LLM-Based Detection of Malicious Package Updates in npm

Wyss, E., Tassio, D., Carli, L. D., & Davidson, D. (2025) · International Symposium on Research in Attacks, Intrusions and Defenses (RAID) · doi:10.1109/raid67961.2025.00047 · Cited by 1

AI-Assisted Detection of Malicious Changes in Infrastructure-as-Code for Secure DevOps

Sudarsan, S., Agrawal, M., & Banerjee, A. (2026) · IEEE International Conference on AI in Cybersecurity (ICAIC) · doi:10.1109/icaic67076.2026.11395715 · Cited by 1

Snake in the Grass: A Hybrid Detection Method Targeting Malicious PyPI Packages

Huang, C., Zeng, Y., Liang, G., Yang, Z. Y., & Du, Y. (2026) · IEEE Transactions on Reliability · doi:10.1109/tr.2026.3676895 · Cited by 1

Execution-as-Configuration: Security Smells in Model Configuration Artifacts

Siddiq, M. L., Johnson, P. N., & Santos, J. C. S. (2026) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3832783.3837470

Open source digital sovereignty: the case for a Canadian national Linux distribution

Pearce, J. M. (2026) · Digital Policy Regulation and Governance · doi:10.1108/dprg-06-2026-0347 · Cited by 1

If You've Seen One, You've Seen Them All: Leveraging AST Clustering Using MCL to Mimic Expertise to Detect Software Supply Chain Attacks.

Ohm, M., Kempf, L., Boes, F., & Meier, M. (2020) · Cited by 1

Digital Supply Chain Dependency and Resilience

Gjesvik, L., Khanyari, A. L., Bryhni, H., Arouna, A., & Schia, N. N. (2023) · International Conference on Cyber Conflict · doi:10.23919/cycon58705.2023.10181978 · Cited by 1

Assessing the Threat Level of Software Supply Chains with the Log Model

Soeiro, L., Robert, T., & Zacchiroli, S. (2023) · IEEE International Conference on Big Data (BigData) · doi:10.1109/bigdata59044.2023.10386091 · Cited by 1

A Survey of Satellite Internet Network Attack and Defense Techniques

Yanyan, H., Gang, G., Wu, J., & Peiliang, Z. (2023) · Cross Strait Radio Science and Wireless Technology Conference (CSRSWTC) · doi:10.1109/csrswtc60855.2023.10426896 · Cited by 1

Assessing Maintainability Risks in the Open Source Software Supply Chain: An Empirical Quality Approach

Bi, F., Zhao, S., Wang, W., & Wu, S. (2024) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac61105.2024.00039 · Cited by 1

GENIE: Guarding the npm Ecosystem with Semantic Malware Detection

Gobbi, M. F., & Kinder, J. (2024) · IEEE Secure Development Conference (SecDev) · doi:10.1109/secdev61143.2024.00017 · Cited by 1

MASS Cybersecurity

Tam, K. (2024) · WMU studies in maritime affairs · doi:10.1007/978-3-031-69437-0_9 · Cited by 1

ROSA: Finding Backdoors with Fuzzing

Kokkonis, D., Marcozzi, M., Decoux, E., & Zacchiroli, S. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00183 · Cited by 1

Hardware-Enforced Integrity and Provenance for Distributed Code DeploymentsPreprint

Melara, M. S., & Bowman, M. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.09843 · Cited by 1

AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance

Campbell, R. (2026) · Systems · doi:10.3390/systems14050593 · Cited by 3

Towards Build Verifiability for Java-based Systems

Xiong, J., Shi, Y., Chen, B., Cogo, F. R., & Jiang, Z. M. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip55303.2022.9793937

Exploring Healthcare Cybersecurity Systems in the Age of COVID-19

Richardson, K., Burrell, D. N., Mingo, H. C., Ferreras-Perez, J., Shen, P., Muller, S. R., Bessette, D. I., & Khanta, K. (2023) · Advances in information security, privacy, and ethics book series · doi:10.4018/978-1-6684-7207-1.ch014

Modeling of Advanced Threat Actors: Characterization, Categorization and Detection

Villalón-Huerta, A. (2023) · RiuNet (Universitat Politècnica de València) · doi:10.4995/thesis/10251/193855 · Cited by 2

How Emerging Technologies Spawn New Social Engineering Paradigms

Mingo, H. C. (2023) · Advances in business strategy and competitive advantage book series · doi:10.4018/979-8-3693-1634-4.ch003

ZTD$_{JAVA}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust DependenciesPreprint

Amusuo, P. C., Robinson, K. A., Singla, T., Peng, H., Machiry, A., Torres-Arias, S., Simon, L., & Davis, J. C. (2023) · arXiv (Cornell University) · doi:10.48550/arxiv.2310.14117

Unveiling the Software Supply Chain Paradigm: Architecture, Actors, Challenges, and Security Perspectives

Thabet, K., Bennaceur, J., Hamza, S., & Djemaa, R. B. (2023) · IEEE International Conference on Enabling Technologies: Infrastructure for Collaborative Enterprises (WETICE) · doi:10.1109/wetice57085.2023.10477837

Empirical study on exploitation of dependency-based attacks in Node.js

Yip, D. Y. K. (2022) · doi:10.31274/td-20240329-277

Secure Crowdsource-Based Open-Source Code Verification (SC)^2V

Nahum, M., Grolman, E., Maimon, I., Mimran, D., Brodt, O., Elyashar, A., Elovici, Y., & Shabtai, A. (2024) · ACM Symposium on Applied Computing · doi:10.1145/3605098.3636103

Research on Software Supply Chain Poisoning Attack Detection Scheme Based on Deep Learning

Tang, K., & Fan, S. (2023) · International Conference on Artificial Intelligence and Computer Engineering (ICAICE) · doi:10.1145/3652628.3652768

SWDNet: Stealth Web Shell Detection Technology based on Triplet Network

Zhang, J., Dai, F., Cao, Y., Tan, R., Cui, X., & Liu, Q. (2023) · International Conference on Mobility, Sensing and Networking (MSN) · doi:10.1109/msn60784.2023.00066

On the Risks and Security of Software Updates: A Systematic Literature ReviewPreprint

Cioffi, L. A., & Junior, M. A. S. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4901397

The Technological and Societal Landscape

van Daalen, O. (2024) · Information technology and law series/Information technology & law series · doi:10.1007/978-94-6265-635-2_2 · Cited by 1

Improving Access Control in Heterogeneous Industrial Big Data Systems

Poltavtseva, M. A., & Aleksandrova, E. B. (2024) · International Russian Automation Conference (RusAutoCon) · doi:10.1109/rusautocon61949.2024.10694121

Security Analysis of Dependency Confusion for Third Party Components: A Risk Assessment Framework Based on Source Code Tree MatchingPreprint

Ding, Y., Tian, W., & Cui, B. (2024) · Research Square · doi:10.21203/rs.3.rs-5261746/v1

Proposal of Open Source Software Security Risk Indicator Based on Vulnerability Management Interview

Kuzuno, H., Yano, T., Omo, K., van der Ham, J., & Yamauchi, T. (2024) · Journal of Information Processing · doi:10.2197/ipsjjip.32.1090

Unraveling Challenges with Supply-Chain Levels for Software Artifacts (Slsa) for Securing the Software Supply ChainPreprint

Tamanna, M., Hamer, S., Tran, M., Fahl, S., Acar, Y., & Williams, L. A. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5119626

Introducing Software Supply Chain

Wang, Y., Cheung, S.-C., Yu, H., & Zhu, Z. (2024) · Springer eBooks · doi:10.1007/978-981-96-1797-5_1

Common Types of Dependency Issues

Wang, Y., Cheung, S.-C., Yu, H., & Zhu, Z. (2024) · Springer eBooks · doi:10.1007/978-981-96-1797-5_3

Security Analysis for Third-Party Component Dependency Confusion: A Risk Assessment Framework Based on Source Code Tree Matching

Ding, Y., & Cui, B. (2024) · IEEE International Conference on Frontiers Technology of Information and Computer (ICFTIC) · doi:10.1109/icftic64248.2024.10912978

You Can’t Touch This: Detecting Typosquatting Packages for Enhanced Malware Prevention in Software Supply Chains

Truong, M., Gruschka, N., & Iacono, L. L. (2025) · Lecture notes in computer science · doi:10.1007/978-981-96-3531-3_8

CloudCover: Enforcement of Multi-Hop Network Connections in Microservice Deployments

Brucker-Hahn, D. A., Feng, W., Li, S., Petillo, M., Bardas, A. G., Davidson, D., & Ji, Y. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00095

Minimizing the expected cybersecurity loss in a software supply chain through scheduling scanning jobs

Wang, J.-Y. (2025) · Computers & Operations Research · doi:10.1016/j.cor.2025.107064

Maldet: An Automated Malicious npm Package Detector Based on Behavior Characteristics and Attack Vectors

Zhang, Y., Qu, H., Ying, L., & Wang, L. (2024) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom63139.2024.00269

Probabilistic Measurement of CTI Quality for Large Numbers of Unstructured CTI Products

Sakellariou, G., Katsantonis, M. N., & Fouliras, P. (2025) · Electronics · doi:10.3390/electronics14091826

A Scoping Study: Crime and Connected and Autonomous VehiclesPreprint

Brown, A., Johnson, S. D., & Tuptuk, N. (2025) · doi:10.31235/osf.io/mkgav_v2

OSPtrack: A Labeled Dataset Targeting Simulated Execution of Open-Source Software

Tan, Z., Anagnostopoulos, C., & Singer, J. (2025) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr66628.2025.00102

Build and Runtime Integrity for Java

Sharma, A. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion66252.2025.00042

Come Together: Sbom-Enhanced Vulnerability Assessment in Safety-Critical SystemsPreprint

Dalia, G., Sgueglia, A., Coppolaro, M., Sorbo, A. D., & Visaggio, C. A. (2025) · SSRN Electronic Journal · doi:10.2139/ssrn.5362510

Proactive defense through automated cyber threat detection and intelligence: Latest trends and challenges

Lahare, P. A., & Wakchaure, M. A. (2025) · AIP conference proceedings · doi:10.1063/5.0289488

Tool or Toy: Are SCA tools ready for challenging scenarios?

Shu, C., Chen, W., Fan, G., Yu, H., Huang, Z., & Liang, Y. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104624

An Exploratory Study on Teaching Software Supply Chain Security Concepts to High School Students

Ohm, M., Börgener, Y., & Pohl, T. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-00644-8_2

MMEF-SSCT: A novel multidimensional and multi-level comprehensive evaluation framework for software supply chain threats

Wang, M., Luo, Q., Wu, P., & Zheng, H. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.128924

Using LSMs to Strengthen Access Control of Applications that use hostPath in Kubernetes Clusters

Medeiros, R., Sampaio, L., Agra, R., & Gomes, R. (2025) · Simpósio Brasileiro de Cibersegurança (SBSeg) · doi:10.5753/sbseg.2025.11402

Guarding LLM-aided Software Transformation Tasks via Component Exoskeletons

Lamprou, E., Kalhauge, C. G., Rinard, M., & Vasilakis, N. (2025) · Workshop on Practical Adoption Challenges of ML for Systems (PACMI) · doi:10.1145/3766882.3767171

JASMaint: Portable Multi-language Taint Analysis for the Web

Stuker, A., Munsters, A., Pupo, A. L. S., Christophe, L., & Boix, E. G. (2025) · ACM SIGPLAN International Conference on Managed Programming Languages and Runtimes (MPLR) · doi:10.1145/3759426.3760982

Unraveling the Characterization and Propagation of Security Vulnerabilities in TensorFlow-based Deep Learning Software Supply Chain

Zhou, Y., Gong, L., & Ma, T. (2025) · Asia-Pacific Symposium on Internetware · doi:10.1145/3755881.3755923

Don’t Stop Receiving: Ensuring Availability of Critical Services on Compromised Mobile Devices

Eyck, T. V., More, S., Draschbacher, F., Michiels, S., & Hughes, D. (2025) · IEEE International Symposium on Network Computing and Applications (NCA) · doi:10.1109/nca67271.2025.00032

You Can't Touch This: Detecting Typosquatting Packages for Enhanced Malware Prevention in Software Supply Chains

Truong, M., Gruschka, N., & Iacono, L. L. (2024) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.13855569

Towards detection of software supply chain attacks by forensic artifacts

Ohm, M., Sykosch, A., & Meier, M. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3409183 · Cited by 58

SoK: Practical Detection of Software Supply Chain Attacks

Ohm, M., & Stuke, C. (2023) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3600160.3600162 · Cited by 29

SoK: Taxonomy of Attacks on Open-Source Software Supply Chains

Ladisa, P., Plate, H., Martinez, M., & Barais, O. (2023) · 2023 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46215.2023.10179304 · Cited by 208

Towards Using Source Code Repositories to Identify Software Supply Chain Attacks

Vu, D., Николаевич, П. И., Massacci, F., Plate, H., & Sabetta, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3420015 · Cited by 62

Machine Learning-Based Detection of Malicious Software Packages in Software Supply Chains: A Comprehensive Survey and Design Framework

Kumar, S., V, Mukhil Kumaran, S., Nayanthara, C., G, S. R., Subhiksha, M., & Kaushika, S. (2026) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.20444717