The DOI matches its Crossref record; 8 of the 9 references it cites were found in a registry or an index.
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Open accessOverview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“Also, software supply chain attacks are becoming increasingly diverse and sophisticated, evolving from simple typosquatting [72] to complex social engineering attacks as in the xz attack [11] and reputation farming [18].”
From Six Million (Suspected) Fake Stars on GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware (2026) · cites this paper as [72]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
On the impact of security vulnerabilities in the npm package dependency network
Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236
Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint
Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147
Detecting Suspicious Package Updates
Garrett, K. A., Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2019) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier.2019.00012 · Cited by 59
Identification of Dependency-based Attacks on Node.js
Pfretzschner, B., & Othmane, L. B. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3120928 · Cited by 39
Poisoning the software supply chain
Levy, E. (2003) · IEEE Security & Privacy · doi:10.1109/msecp.2003.1203227 · Cited by 34
Security of public continuous integration services
Gruhn, V., Hannebauer, C., & John, C. (2013) · International Symposium on Open Collaboration · doi:10.1145/2491055.2491070 · Cited by 24
An Empirical Analysis of Vulnerabilities in Python Packages for Web Applications
Ruohonen, J. (2018) · International Workshop on Empirical Software Engineering in Practice (IWESEP) · doi:10.1109/iwesep.2018.00013 · Cited by 20
Security Issues in Language-based Software EcosystemsPreprint
Vaidya, R. K., Carli, L. D., Davidson, D., et al. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1903.02613 · Cited by 3
Research works printed but not linked: 1
- Tschacher, N.P.: Typosquatting in programming language package managers. Master’s thesis, Universität Hamburg, Fachbereich Informatik (2016)
Cited by
Sorted by citations
Evaluating Large Language Models Trained on Code
Chen, M., Tworek, J., Jun, H., Yuan, Q., Pinto, H. P. D. O., Kaplan, J., Edwards, H., Burda, Y., Joseph, N., Brockman, G., et al. (2021) · arXiv · doi:10.48550/arxiv.2107.03374 · Cited by 1,436
“20 Also worrying is the possibility of Codex suggesting malicious or typosquatted packages (Ohm et al., 2020).”
BackgroundSoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Ladisa, P., Plate, H., Martinez, M., & Barais, O. (2023) · 2023 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46215.2023.10179304 · Cited by 208
Self-citationWhat are weak links in the npm supply chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513044 · Cited by 104
An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead
Xia, B., Bi, T., Xing, Z., Lu, Q., & Zhu, L. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00219 · Cited by 101
Reproducible Builds: Increasing the Integrity of Software Supply Chains
Lamb, C., & Zacchiroli, S. (2021) · IEEE Software · doi:10.1109/ms.2021.3073045 · Cited by 90
Metadata
- Authors
- Ohm, M., Plate, H., Sykosch, A., & Meier, M.
- Affiliations
- University of Bonn (DE)
- Corresponding author
- Ohm, Marc
- Venue
- Lecture Notes in Computer Science
- Publisher
- Springer International Publishing
- Published
- 2020
- Pages
- 23-43
- ISSN
- 0302-9743 (ISSN-L)
- 1611-3349
- PMC
- PMC7338168
- OpenAlex
- W3028285817
- Cited by
- 259
- References
- 9
- Citations by year
- 2026: 61 · 2025: 61 · 2024: 50 · 2023: 44 · 2022: 24 · 2021: 15 · 2020: 4
- FWCI
- 16.50
- Type
- conference paper
- Language
- en
- Open access
- green
- www.ncbi.nlm.nih.gov
- Locations
- Lecture notes in computer science (publishedVersion)
- PubMed Central (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- Publikationsdatenbank der Fraunhofer-Gesellschaft (Fraunhofer-Gesellschaft) (submittedVersion)
- Fraunhofer-Publica (Fraunhofer-Gesellschaft) (submittedVersion)
- arXiv (Cornell University)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Software › Advanced Malware Detection Techniques
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- software supply chain attacks, open source software, npm, PyPI, RubyGems
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
