The DOI matches its Crossref record; 8 of the 9 references it cites were found in a registry or an index.
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Open accessOverview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Also, software supply chain attacks are becoming increasingly diverse and sophisticated, evolving from simple typosquatting [72] to complex social engineering attacks as in the xz attack [11] and reputation farming [18].”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [72]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
On the impact of security vulnerabilities in the npm package dependency network
Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236
Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint
Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147
Detecting Suspicious Package Updates
Garrett, K. A., Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2019) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier.2019.00012 · Cited by 59
Identification of Dependency-based Attacks on Node.js
Pfretzschner, B., & Othmane, L. B. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3120928 · Cited by 39
Poisoning the software supply chain
Levy, E. (2003) · IEEE Security & Privacy · doi:10.1109/msecp.2003.1203227 · Cited by 34
Security of public continuous integration services
Gruhn, V., Hannebauer, C., & John, C. (2013) · International Symposium on Open Collaboration · doi:10.1145/2491055.2491070 · Cited by 24
An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications
Ruohonen, J. (2018) · International Workshop on Empirical Software Engineering in Practice (IWESEP) · doi:10.1109/iwesep.2018.00013 · Cited by 20
Security Issues in Language-based Software EcosystemsPreprint
Vaidya, R. K., Carli, L. D., Davidson, D., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.02613 · Cited by 3
Research works printed but not linked: 1
- Tschacher, N.P.: Typosquatting in programming language package managers. Master’s thesis, Universität Hamburg, Fachbereich Informatik (2016)
Cited by
Sorted by citations
Items 201–260 of 260
Eler: Ensemble Learning-Based Automated Verification of Code Clones
Dou, S., Hu, Y., Feng, S., Wu, Y., & Zou, D. (2026) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2026.3656384
Cai, Z., Cai, Y., Leng, T., Zhou, H., Xie, X., Sun, Y., Chai, Y., & Qiu, J. (2025) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc67331.2025.00044
ACCI: A Multi-Feature PyPI Package Anomaly Detection Method Based on Script Deep Semantics
Xie, X., Feng, Q., Leng, T., Zhou, H., Cai, Y., Cai, Z., Qiu, J., & Chai, Y. (2025) · IEEE International Conference on Data Science in Cyberspace · doi:10.1109/dsc67331.2025.00043
Finding software vulnerabilities in large C projects via bounded model checking
de Sousa, J. O., Farias, B., da Silva, T. A., Tihanyi, N., Dubniczky, R. A., Filho, E. B. D. L., & Cordeiro, L. C. (2026) · International Journal on Software Tools for Technology Transfer · doi:10.1007/s10009-026-00838-0
SemanticSentinel: LLM-Based Semantic Consistency for Malicious Package Detection
Huang, R., & Qu, H. (2025) · International Conference on Communication Technology and Information Technology (ICCTIT) · doi:10.1109/icctit68197.2025.11406234
A Multi-Cloud Framework for Zero Trust Workload Authentication
Deochake, S., Murphy, R., & Gearheart, J. (2025) · Annual Computer Security Applications Conference Workshops (ACSAC Workshops) · doi:10.1109/acsacw69556.2025.00061 · Cited by 5
Iweriebor, L. E., & Lewis, E. J. M. (2026) · IGI Global eBooks · doi:10.4018/979-8-2600-1021-1.ch005
Plate, H. (2024) · doi:10.70675/19d4cfb4za969z40a3z8c79z4060c26a7e44
Self-citationUnderstanding and preventing open-source software supply chain attacks
Ladisa, P. (2024) · theses.fr (ABES) · doi:10.70675/70265dd7z4bbdz41c2za9f2zbfed786b5894
Jaspa, V., & Singh, R. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.6570860
Patwary, M. O., Jarin, R., Biswas, A., Partho, M. M. T., Gomes, D., & Islam, M. R. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-2600-1608-4.ch008
Shape-Shifting Malicious Code in Software Backdoors via Language Models
Fard, M. E., Weißberg, F., Imgrund, E., Eisenhofer, T., & Rieck, K. (2026) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3779208.3807485
Revisiting the QUT-DV25 Benchmark: Interpretable Feature-Fused Models for PyPI Malware Detection
Wasi, S. R., & Hira, S. I. (2026) · IEEE International Conference on Quantum Photonics, Artificial Intelligence & Networking (QPAIN) · doi:10.1109/qpain69676.2026.11545547
VSMEx: A Collection Tool and a Dataset of Malicious VS Code Extensions: Data/Toolset Paper
Alachkar, K., Gaastra, D., Gadyatskaya, O., Bárbaro, E., van Eeten, M. J. G., & Zhauniarovich, Y. (2026) · ACM Conference on Data and Application Security and Privacy (CODASPY) · doi:10.1145/3800506.3803487
Static Detection of Compromised Java Components by Topological Anomalies
de Paiva, O. Z., Ruggiero, W. V., & Junior, M. A. S. (2026) · Communications in computer and information science · doi:10.1007/978-3-032-28957-5_13
Supply Chain Security of PCR Tests
Barkay, N., Motro, Y., Moran-Gilad, J., & Puzis, R. (2026) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw72489.2026.00012
Uncovering Similar but Different Packages in PyPI and Potential Security Threats
Park, S., Han, S., & Woo, S. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3808217
On the Variability of Source Code in Maven Package Rebuilds
Dietrich, J. B., & Hassanshahi, B. (2026) · IEEE Secure Development Conference (SecDev) · doi:10.1145/3805773.3805997
The SBOM Gap: Adoption and Compliance in Open Source Software
Rabbi, M. F., Turzo, A. K., Champa, A. I., & Zibran, M. F. (2026) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner67736.2026.00124
Prevention and Dynamic Analysis of Supply Chain Attacks in Academic Python Environments
Sedov, D., Lazarev, A., & Galkin, A. G. (2026) · International Conference on Technology Enhanced Learning in Higher Education (TELE) · doi:10.1109/tele71748.2026.11591271
VCAligner: Aligning Source Distribution Versions with Upstream Git Commits to Secure Supply Chain
Li, Y., Jiang, N., Zhou, Q., Xu, S., Xie, Y., & Jia, X. (2026) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn69566.2026.00048
Attestable Build Chain: Enabling Trust in Reproducible Builds
Muto, K., & Suzaki, K. (2026) · International Conference on Dependable Systems and Networks workshops · doi:10.1109/dsn-w70714.2026.00051
Supply-Chain-Attacken – Software Supply Chains als unterschätzte cyberkritische Infrastruktur
Fotis, F., Freye, C., Melcher, S., & Kluth, S. (2026) · FOM-Edition · doi:10.1007/978-3-658-50615-5_9
Understanding and Detecting GitHub Impersonation through Automated Authorship Attribution
Zhang, Y., Zhang, Y., Wisniewski, P., Zhang, F., Leach, K., & Huang, Y. (2026) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3830464
Kadali, R. S. (2026) · IGI Global eBooks · doi:10.4018/979-8-3373-8277-7.ch008
Ahmed, S., Rahman, S., Ifa, K. T. F., & Chowdhury, P. (2026) · IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) · doi:10.1109/icstw72326.2026.00026
Oktenli, B. (2026) · Journal of Hardware and Systems Security · doi:10.1007/s41635-026-00190-4
STĂNCIULESCU, A. (2026) · International Conference on Electronics, Computers and Artificial Intelligence (ECAI) · doi:10.1109/ecai69016.2026.11613644
SupplyTGN: A Reproducible Leakage-Safe Benchmark for Temporal Software Supply-Chain RiskPreprint
Tran-Truong, P. T., Son, H. X., & Le, X.-B. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7194447
Guo, R., Hu, N., Ma, Y., Huang, Z., Peng, F., Li, G., & Wen, G. (2026) · Aerospace · doi:10.3390/aerospace13080683
Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order
Reyes, F., Bono, F., Sharma, A., Baudry, B., & Monperrus, M. (2025) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3733827.3765523
SoK: A Defense-Oriented Evaluation of Software Supply Chain Security
Ishgair, E. A., Gomez, J., Melara, M. S., Cárdenas, Á. A., & Torres-Arias, S. (2026) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp68448.2026.00059
Security Assessment of Private Package Repositories: An Experience on Acc‐Py at CERN
Lizzit, M., Pinzauti, F., Marino Miculan, A., & Riccio, V. (2026) · Journal of Software Evolution and Process · doi:10.1002/smr.70159
LogLearners: Identifying Compromised AI Functions in Serverless Systems
Bhutto, A. B., Elmroth, E., & Bhuyan, M. H. (2026) · IEEE/ACM International Symposium on Cluster, Cloud and Grid Computing (CCGrid) · doi:10.1109/ccgrid68966.2026.00077
Software Supply Chain Vulnerability Analysis and Visualization
Varshini, M., Mathur, S., & Nagasundari, S. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-27754-1_31
Governance and Interdependence in Data-Driven Supply Chains
Cobbe, J. (2026) · Cambridge University Press eBooks · doi:10.1017/9781009425308.011
Piao, Y., & Zhang, Z. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7275142
From Fake Job Offer to Full Environment Compromise: Anatomy of the Contagious Interview Campaign
Pitumpe, A., Podleski, J., Khanlari, A., Dziubecki, P., Muthukumaramani, D., & Rahmati, A. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-35586-7_17
Bai, H., Zhang, J., Li, H., Fu, X., siya, A., & Hao, Y. (2026) · Journal of King Saud University - Computer and Information Sciences · doi:10.1007/s44443-026-01121-7
Sistemski napadi na programske dobavne verige v dobi umetne inteligence
Jošt, G., & Taneski, V. (2026) · OTS Sodobne informacijske tehnologije in storitve (OTS) · doi:10.18690/um.feri.7.2026.11
Bai, R., Lin, S., Liu, X., Fan, K., Lu, B., Lu, Y., & Wu, W. (2026) · Mathematics · doi:10.3390/math14183250
Urs, P. G., & Mureşan, V. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6050158
Malicious Repository Detection Using Transformer-Based Models: A Metadata-Driven Approach
Mouty, R., & Abdullah-Al-Wadud, M. (2026) · IEEE Access · doi:10.1109/access.2026.3732697
Metadata Compressibility and Evaluation Bias in Malicious Package Detection for NPM and PyPI
Moufid, H., Ghazouani, M. E., & Kiram, M. A. E. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6050160
Understanding DevOps Security of Google Workspace Apps
Wan, L., Yan, C., Liu, Z., Wang, H., & Bai, G. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773245
IntelliRadar: A Comprehensive Platform to Pinpoint Malicious Packages from Cyber Intelligence
Guo, W., Liu, C., Wang, L., Zhang, Y., Wu, J., Xu, Z., & Liu, Y. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773113 · Cited by 5
Bhuvaneswari, S., Abirami, A., Karthi Raman, M., Sekar, K. S., Mohamed Rafeeq Khan, A., & Sai, R., V (2026) · International Conference on Modern Sustainable Systems (CMSS) · doi:10.1109/cmss69636.2026.11689444
Fighting Supply Chain Attacks with Effect Systems
Madsen, M., Larsen, A. S., Villumsen, J. S., & Askarov, A. (2026) · Proceedings of the ACM on Programming Languages · doi:10.1145/3839494
WITFuzz: Validity-Preserving Greybox Fuzzing for WebAssembly Interface Type Binding Generators
Guan, H., He, N., Cao, S., Cai, Y., Guo, Y., & Li, D. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3832281
PackMonitor: Towards Zero Package Hallucinations via Decoding-Time Monitoring
Liu, X., Liu, Y., Zhang, Y., Li, J., & Hu, S. (2026) · Proceedings of the ACM on software engineering. · doi:10.1145/3832118 · Cited by 3
Artifacts to Actors: Assessing the Maturity of Software Supply Chain Security Measurement Practices
Butler, A., O’Keeffe, D., & Dash, S. K. (2026) · doi:10.1145/3843781.3844628
Context-Aware Trust Verification for Identity-Based Software Signing
Okafor, C., Davis, J. C., & Torres-Arias, S. (2026) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3832783.3834333 · Cited by 5
Mejías, A. I. V., Charlo, R. E. R., & Alcaide, J. I. (2026) · Metrics · doi:10.3390/metrics3040023
Raszka, L., & Grycz, O. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7592667
Who Pays to Secure Shared Components? A Pay-for-Performance Model for Cyber Insurance
Chester, J., & Hastings, A. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-40367-4_11
OSSGuard: A Game-Theoretic Framework for Trust and Security in Open-Source Ecosystems
Koushyar, J. M., Guirguis, M., & Atia, G. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-40367-4_29
The Hand-fly Effect: Investigating the Prevalence of Shift-Squatting in the Wild
Zhao, H., Hester, S., Liang, X., Hao, S., Gao, X., & Liu, G. (2026) · IEEE Conference on Communications and Network Security · doi:10.1109/cns69863.2026.11720892
Vulnerability Evolution and the Promise of Automated Gatekeeping in Open-Source Software
Akhavani, S. A., Ousat, B., Uluagac, S., & Kharraz, A. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-42939-1_3
Kurogome, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-42939-1_2
Metadata
- Authors
- Ohm, M., Plate, H., Sykosch, A., & Meier, M.
- Affiliations
- University of Bonn (DE)
- Corresponding author
- Ohm, Marc
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2020
- Pages
- 23-43
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- PMC
- PMC7338168
- OpenAlex
- W3028285817
- Cited by
- 259
- References
- 9
- Citations by year
- 2026: 61 · 2025: 61 · 2024: 50 · 2023: 44 · 2022: 24 · 2021: 15 · 2020: 4
- FWCI
- 16.50
- Type
- conference paper
- Language
- en
- Open access
- green
- www.ncbi.nlm.nih.gov
- Locations
- Lecture notes in computer science (publishedVersion)
- PubMed Central (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft) (submittedVersion)
- Fraunhofer-Publica (Fraunhofer-Gesellschaft) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Software › Advanced Malware Detection Techniques
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- software supply chain attacks, open source software, npm, PyPI, RubyGems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
