Exposing the Hidden Layer: Software Repositories in the Service of Seo Manipulation
Abstract
Distinct from traditional malicious packages, this paper uncovers a novel attack vector named “blackhat Search Engine Optimization through REPositories (RepSEO)”. In this approach, attackers carefully craft packages to manipulate search engine results, exploiting the credibility of software repositories to promote illicit websites. Our research presents a systematic analysis of the underground ecosystem of RepSEO, identifying key players such as account providers, advertisers, and publishers. We developed an effective detection tool, applied to a ten-year large-scale dataset of npm, Docker Hub, and NuGet software repositories. This investigation led to the startling discovery of 3,801,682 abusive packages, highlighting the widespread nature of this attack. Our study also delves into the supply chain tactics of these attacks, revealing strategies like the use of self-hosted email services for account registration, redirection methods to obscure landing pages, and rapid deployment techniques by aggressive attackers. Additionally, we explore the profit motives behind these attacks, identifying two primary types of advertisers: survey-based advertisers and malware distribution advertisers. We reported npm, NuGet, and Docker Hub about the RepSEO packages and the related supply chain vulnerabilities of Google, and received their acknowledgments. Software repositories have started removing the abusive packages as of this paper's submission. We also opensource our code and data to facilitate future research.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Cites
BERT: Pre-training of Deep Bidirectional Transformers for Language Understanding
Devlin, J., Chang, M.-W., Lee, K., & Toutanova, K. (2019) · Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers) · doi:10.18653/v1/n19-1423 · Cited by 48,293 · see citing works
Answering the Call for a Standard Reliability Measure for Coding Data
Hayes, A. F., & Krippendorff, K. (2007) · Communication Methods and Measures · doi:10.1080/19312450709336664 · Cited by 4,225 · see citing works
hdbscan: Hierarchical density based clustering
McInnes, L., Healy, J., & Astels, S. (2017) · The Journal of Open Source Software · doi:10.21105/joss.00205 · Cited by 2,833 · see citing works
Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation
Pochat, V. L., Goethem, T. V., Tajalizadehkhoob, S., Korczyński, M., & Joosen, W. (2019) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2019.23386 · Cited by 598 · see citing works
Suspended accounts in retrospect: an analysis of twitter spam
Thomas, K., Grier, C., Song, D., & Paxson, V. (2011) · Proceedings of the 2011 ACM SIGCOMM conference on Internet measurement conference · doi:10.1145/2068816.2068840 · Cited by 439 · see citing works
An empirical comparison of dependency network evolution in seven software packaging ecosystems
Decan, A., Mens, T., & Grosjean, P. (2018) · Empirical Software Engineering · doi:10.1007/s10664-017-9589-y · Cited by 264 · see citing works
On the impact of security vulnerabilities in the npm package dependency network
Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236 · see citing works
SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Ladisa, P., Plate, H., Martinez, M., & Barais, O. (2023) · 2023 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46215.2023.10179304 · Cited by 208 · see citing works
Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint
Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147 · see citing works
Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages
Duan, R., Alrawi, O., Kasturi, R. P., Elder, R., Saltaformaggio, B., & Lee, W. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.23055 · Cited by 121 · see citing works
Twitter-Based Detection of Illegal Online Sale of Prescription Opioid
Mackey, T. K., Kalyanam, J., Katsuki, T., & Lanckriet, G. R. G. (2017) · American Journal of Public Health · doi:10.2105/ajph.2017.303994 · Cited by 104 · see citing works
What are weak links in the npm supply chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513044 · Cited by 104 · see citing works
Doppelgänger Finder: Taking Stylometry to the Underground
Afroz, S., Islam, A. C., Stolerman, A., Greenstadt, R., & McCoy, D. (2014) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2014.21 · Cited by 101 · see citing works
Lu, L. J., Perdisci, R., & Lee, W. (2011) · Proceedings of the ACM Conference on Computer and Communications Security · doi:10.1145/2046707.2046762 · Cited by 88 · see citing works
Measuring and Analyzing Search-Redirection Attacks in the Illicit Online Prescription Drug Trade
Leontiadis, N. (2011) · Cited by 88 · see citing works
SYNODE: Understanding and Automatically Preventing Injection Attacks on NODE.JS
Staicu, C.-A., Pradel, M., & Livshits, B. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23071 · Cited by 87 · see citing works
Practical automated detection of malicious npm packages
Sejfia, A., & Schäfer, M. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510104 · Cited by 86 · see citing works
Towards Using Source Code Repositories to Identify Software Supply Chain Attacks
Vu, D., Николаевич, П. И., Massacci, F., Plate, H., & Sabetta, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3420015 · Cited by 62 · see citing works
Surveylance: Automatically Detecting Online Survey Scams
Kharraz, A., Robertson, W., & Kirda, E. (2018) · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy · doi:10.1109/sp.2018.00044 · Cited by 61 · see citing works
Zhang, Y., Fan, Y., Song, W. G., Hou, S., Ye, Y., Li, X., Zhao, L., Shi, C., Wang, J., & Xiong, Q. (2019) · International World Wide Web Conference (WWW) · doi:10.1145/3308558.3313537 · Cited by 61 · see citing works
A Nearly Four-Year Longitudinal Study of Search-Engine Poisoning
Leontiadis, N., Moore, T., & Christin, N. (2014) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2660267.2660332 · Cited by 60 · see citing works
Liao, X., Yuan, K., Wang, X., Pei, Z., Yang, H., Chen, J., Duan, H., Du, K., Alowaisheq, E., Alrwais, S. A., et al. (2016) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2016.48 · Cited by 41 · see citing works
Self-citationWhat You See is NOT What You Get
Vadrevu, P., & Perdisci, R. (2019) · Internet Measurement Conference · doi:10.1145/3355369.3355600 · Cited by 40 · see citing works
Characterizing Long-tail SEO Spam on Cloud Web Hosting Services
Liao, X., Liu, C., McCoy, D., Shi, E., Hao, S., & Beyah, R. (2016) · International World Wide Web Conference (WWW) · doi:10.1145/2872427.2883008 · Cited by 32 · see citing works
Wang, D. Y., Der, M. F., Karami, M., Saul, L. K., McCoy, D., Savage, S., & Voelker, G. M. (2014) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2663716.2663738 · Cited by 30 · see citing works
Privacy: Gone with the Typing! Identifying Web Users by Their Typing Patterns
Chairunnanda, P., Pham, N., & Hengartner, U. (2011) · doi:10.1109/passat/socialcom.2011.197 · Cited by 29 · see citing works
Davis, J. C., Williamson, E., & Lee, D. (2018) · USENIX Security Symposium · Cited by 29 · see citing works
Investigating Package Related Security Threats in Software Registries
Gu, Y., Ying, L., Pu, Y., Hu, X., Chai, H., Wang, R., Gao, X. H., & Duan, H. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179332 · Cited by 24 · see citing works
Self-citationGame of Missuggestions: Semantic Analysis of Search-Autocomplete Manipulations
Wang, P., Mi, X., Liao, X., Wang, X., Yuan, K., Qian, F., & Beyah, R. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23036 · Cited by 22 · see citing works
Trojan Source: Invisible VulnerabilitiesPreprint
Boucher, N., & Anderson, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.00169 · Cited by 14 · see citing works
Pinning Down Abuse on Google Maps
Huang, D. Y., Grundman, D., Thomas, K., Kumar, A., Bursztein, E., Levchenko, K., & Snoeren, A. C. (2017) · International World Wide Web Conference (WWW) · doi:10.1145/3038912.3052590 · Cited by 10 · see citing works
Measuring and Analyzing Search Engine Poisoning of Linguistic Collisions
Joslin, M., Li, N., Hao, S., Xue, M., & Zhu, H. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00025 · Cited by 10 · see citing works
Demystifying Local Business Search Poisoning for Illicit Drug Promotion
Wang, P., Lin, Z., Liao, X., & Wang, X. (2022) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2022.24284 · Cited by 6 · see citing works
MAWSEO: Adversarial Wiki Search Poisoning for Illicit Online Promotion
Lin, Z., Li, Z., Liao, X., Wang, X., & Liu, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00049 · Cited by 6 · see citing works
Mingling of Clear and Muddy Water: Understanding and Detecting Semantic Confusion in Blackhat SEO
Yang, H., Du, K., Zhang, Y., Hao, S., Wang, H., Jia, Z., & Duan, H. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-88418-5_13 · Cited by 5 · see citing works
Self-citation
Flagged first, then by citations
1 of the 36 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 2 · see citing works
Detection and Analysis of Poisoned Image in Container Registry
Pang, S., Wang, Y., Yao, Y., Jiang, Z., Fan, Z., & Liu, B. (2025) · Proceedings/Proceedings - International Symposium on Software Reliability Engineering · doi:10.1109/issre66568.2025.00051
SEO Poisoning as a Hidden Vector of Cyber Risk and Organizational Compromise
Jones, L. A. (2026) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-9918-8.ch008
- Authors
- Wu, M., Hong, G., Mai, W., Wu, X., Zhang, L., Pu, Y., Chai, H., Ying, L., Duan, H., & Yang, M.
- Affiliations
- Fudan University (CN)
- QI-ANXIN Technology Research Institute,China
- Tsinghua University (CN)
- Venue
- 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE)
- Publisher
- IEEE
- Published
- 2025-04-26
- Pages
- 2100-2112
- ISSN
- 0270-5257 (ISSN-L)
- OpenAlex
- W4411552205
- Cited by
- 3
- References
- 36
- Citations by year
- 2026: 2 · 2025: 1
- FWCI
- 3.43
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Cybercrime and Law Enforcement Studies
- Keywords
- software repositories, npm, Docker Hub, NuGet, supply chain attacks, malware distribution
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
