SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Open accessAbstract
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today’s open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims.This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
PQC transition affects TLS, certificate chains, and secure enclaves due to increased key sizes, larger signature sizes, and hybrid mode requirements during the transition period.
“PQC transition affects all three due to increased key sizes, larger signature sizes, and hybrid mode requirements during the transition period [17,18].”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
The paper’s List of Safeguards discusses code signing and signature verification for open-source software supply chains, but not the effects of a post-quantum cryptography transition. Searches for PQC, TLS, certificate chains, secure enclaves, key and signature sizes, and hybrid modes found no passage addressing the attributed claim. Page numbers were not available in our copy. (LLM, conf=0.78)
Experimental — accuracy not yet measuredIETF drafts for hybrid key exchange [17,18], PQC certificate profiles, and composite signature formats are still in progress.
“IETF drafts for hybrid key exchange [17,18], PQC certificate profiles, and composite signature formats are still in progress.”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
The safeguards table (Additional information, page unavailable) mentions code signing, but not IETF drafts or the status of hybrid key exchange, PQC certificate profiles, or composite signature formats. Searches for those terms and for post-quantum standards found no passage in our copy addressing the claim. (LLM, conf=0.76)
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Systematic Literature Reviews in Software Engineering—A Systematic Literature Review
Kitchenham, B., Pearl Brereton, O., Budgen, D., Turner, M., Bailey, J., & Linkman, S. (2009) · Information and Software Technology · doi:10.1016/j.infsof.2008.09.009 · Cited by 4,537 · see citing works
Experimentation in Software Engineering
Wohlin, C., Runeson, P., Höst, M., Ohlsson, M. C., Regnell, B., & Wesslén, A. (2012) · doi:10.1007/978-3-642-29044-2 · Cited by 4,460 · see citing works
Goodman, L. A. (1961) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177705148 · Cited by 3,606 · see citing works
2017 USENIX Annual Technical Conference (USENIX ATC'17)
Quoc, D. L., Beck, M. S., Bhatotia, P., Chen, R., Fetzer, C. W., & Strufe, T. (2017) · Cited by 3,091 · see citing works
Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J. G., Payer, M., Weaver, N., Adrian, D., Paxson, V., Bailey, M., et al. (2014) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2663716.2663755 · Cited by 692 · see citing works
Thompson, K. (1984) · Communications of the ACM · doi:10.1145/358198.358210 · Cited by 670 · see citing works
Malware Obfuscation Techniques: A Brief Survey
You, I., & Yim, K. (2010) · 2010 International Conference on Broadband, Wireless Computing, Communication and Applications · doi:10.1109/bwcca.2010.85 · Cited by 607 · see citing works
Mauw, S., & Oostdijk, M. (2006) · Lecture notes in computer science · doi:10.1007/11734727_17 · Cited by 504 · see citing works
(2008) · doi:10.1016/b978-0-12-373558-4.x0001-5 · Cited by 287 · see citing works
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-52683-2_2 · Cited by 259 · see citing works
Self-citationOn the impact of security vulnerabilities in the npm package dependency network
Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236 · see citing works
Principles of Sociological Inquiry – Qualitative and Quantitative Methods
Blackstone, A. (2014) · Cited by 154 · see citing works
Intelligence in the internet age: The emergence and evolution of Open Source Intelligence (OSINT)
Glassman, M., & Kang, M. (2011) · Computers in Human Behavior · doi:10.1016/j.chb.2011.11.014 · Cited by 153 · see citing works
Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint
Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147 · see citing works
Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages
Duan, R., Alrawi, O., Kasturi, R. P., Elder, R., Saltaformaggio, B., & Lee, W. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.23055 · Cited by 121 · see citing works
Survivable key compromise in software update systems
Samuel, J., Mathewson, N., Cappos, J., & Dingledine, R. (2010) · Proceedings of the 17th ACM conference on Computer and communications security · doi:10.1145/1866307.1866315 · Cited by 120 · see citing works
Threat analysis of software systems: A systematic literature review
Tuma, K., Çalıklı, G., & Scandariato, R. (2018) · Journal of Systems and Software · doi:10.1016/j.jss.2018.06.073 · Cited by 113 · see citing works
Vulnerable open source dependencies
Николаевич, П. И., Plate, H., Ponta, S. E., Sabetta, A., & Massacci, F. (2018) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1145/3239235.3268920 · Cited by 110 · see citing works
Self-citationSecurity in the Software Development Lifecycle
Assal, H., & Chiasson, S. (2018) · Cited by 107 · see citing works
What are weak links in the npm supply chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513044 · Cited by 104 · see citing works
A comprehensive study of bloated dependencies in the Maven ecosystem
Soto-Valero, C., Harrand, N., Monperrus, M., & Baudry, B. (2021) · Empirical Software Engineering · doi:10.1007/s10664-020-09914-8 · Cited by 102 · see citing works
Impact assessment for vulnerabilities in open-source software libraries
Plate, H., Ponta, S. E., & Sabetta, A. (2015) · IEEE International Conference on Software Maintenance and Evolution (ICSME) · doi:10.1109/icsm.2015.7332492 · Cited by 100 · see citing works
Self-citationReproducible Builds: Increasing the Integrity of Software Supply Chains
Lamb, C., & Zacchiroli, S. (2021) · IEEE Software · doi:10.1109/ms.2021.3073045 · Cited by 90 · see citing works
SYNODE: Understanding and Automatically Preventing Injection Attacks on NODE.JS
Staicu, C.-A., Pradel, M., & Livshits, B. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23071 · Cited by 87 · see citing works
Secure software updates: disappointments and new challenges
Bellissimo, A., Burgess, J., & Fu, K. E. (2006) · Cited by 86 · see citing works
Practical automated detection of malicious npm packages
Sejfia, A., & Schäfer, M. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510104 · Cited by 86 · see citing works
Perspectives on the SolarWinds Incident
Peisert, S., Schneier, B., Okhravi, H., Massacci, F., Benzel, T., Landwehr, C. E., Mannan, M., Mirković, J., Prakash, A., & Michael, J. B. (2021) · IEEE Security & Privacy · doi:10.1109/msec.2021.3051235 · Cited by 84 · see citing works
A comparative study of vulnerability reporting by software composition analysis tools
Imtiaz, N., Thorn, S., & Williams, L. A. (2021) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1145/3475716.3475769 · Cited by 82 · see citing works
Executive Order 14028: Improving the Nation's Cybersecurity
Biden, J. R. (2021) · United States. Office of the Federal Register · Cited by 78 · see citing works
A Practical Approach to the Automatic Classification of Security-Relevant Commits
Sabetta, A., & Michele Bezzi, A. (2018) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme.2018.00058 · Cited by 77 · see citing works
Cappos, J., Samuel, J., Baker, S., & Hartman, J. H. (2008) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1455770.1455841 · Cited by 76 · see citing works
Thirty years later: lessons from the Multics security evaluation
Karger, P. A., & Schell, R. R. (2003) · Annual Computer Security Applications Conference · doi:10.1109/csac.2002.1176285 · Cited by 70 · see citing works
Typosquatting and Combosquatting Attacks on the Python Ecosystem
Vu, D., Николаевич, П. И., Massacci, F., Plate, H., & Sabetta, A. (2020) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw51379.2020.00074 · Cited by 66 · see citing works
Self-citationTowards Using Source Code Repositories to Identify Software Supply Chain Attacks
Vu, D., Николаевич, П. И., Massacci, F., Plate, H., & Sabetta, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3420015 · Cited by 62 · see citing works
Self-citationFass, A., Michael Backes, A., & Stock, B. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3345656 · Cited by 61 · see citing works
Detecting Suspicious Package Updates
Garrett, K. A., Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2019) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier.2019.00012 · Cited by 59 · see citing works
Towards detection of software supply chain attacks by forensic artifacts
Ohm, M., Sykosch, A., & Meier, M. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3409183 · Cited by 58 · see citing works
Anomalicious: Automated Detection of Anomalous and Potentially Malicious Commits on GitHub
Gonzalez, D., Zimmermann, T., Godefroid, P., & Schaefer, M. (2021) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00035 · Cited by 56 · see citing works
LastPyMile: identifying the discrepancy between sources and packages
Vu, D., Massacci, F., Николаевич, П. И., Plate, H., & Sabetta, A. (2021) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3468264.3468592 · Cited by 56 · see citing works
Self-citationBreakApp: Automated, Flexible Application Compartmentalization
Vasilakis, N., Karel, B., Roessler, N., Dautenhahn, N., DeHon, A. M., & Smith, J. M. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23131 · Cited by 54 · see citing works
Identifying unmaintained projects in github
Coelho, J., Valente, M. T., Silva, L. L., & Shihab, E. (2018) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1145/3239235.3240501 · Cited by 54 · see citing works
Containing Malicious Package Updates in npm with a Lightweight Permission System
Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse43902.2021.00121 · Cited by 51 · see citing works
On the impact of using trivial packages: an empirical case study on npm and PyPI
Abdalkareem, R., Oda, V., Mujahid, S., & Shihab, E. (2020) · Empirical Software Engineering · doi:10.1007/s10664-019-09792-9 · Cited by 49 · see citing works
Defending Against Package Typosquatting
Taylor, M., Vaidya, R. K., Davidson, D., Carli, L. D., & Rastogi, V. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-65745-1_7 · Cited by 49 · see citing works
A Socio-technical Framework for Threat Modeling a Software Supply Chain
Sabbagh, B. A., & Kowalski, S. J. (2015) · IEEE Security & Privacy · doi:10.1109/msp.2015.72 · Cited by 45 · see citing works
Pewny, J., & Holz, T. (2016) · doi:10.1145/2991079.2991103 · Cited by 44 · see citing works
Assessing the security of Node.js platform
Ojamaa, A., & Düüna, K. (2012) · International Conference for Internet Technology and Secured Transactions · Cited by 42 · see citing works
Countering Trusting Trust through Diverse Double-Compiling
Wheeler, D. (2006) · Annual Computer Security Applications Conference · doi:10.1109/csac.2005.17 · Cited by 39 · see citing works
Identification of Dependency-based Attacks on Node.js
Pfretzschner, B., & Othmane, L. B. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3120928 · Cited by 39 · see citing works
Identifying unusual commits on GitHub
Goyal, R., Ferreira, G., Kästner, C., & Herbsleb, J. D. (2017) · Journal of Software Evolution and Process · doi:10.1002/smr.1893 · Cited by 38 · see citing works
Empirical Study of Restarted and Flaky Builds on Travis CI
Durieux, T., Goues, C. L., Hilton, M. L., & Abreu, R. (2020) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3379597.3387460 · Cited by 37 · see citing works
Securing a Deployment Pipeline
Bass, L., Holz, R., Rimba, P., Tran, A. B., & Zhu, L. (2015) · doi:10.1109/releng.2015.11 · Cited by 37 · see citing works
in-toto: Providing farm-to-table guarantees for bits and bytes
Torres-Arias, S., Afzali, H., Kuppusamy, T. K., Curtmola, R., & Cappos, J. (2019) · USENIX Security Symposium · Cited by 37 · see citing works
Poisoning the software supply chain
Levy, E. (2003) · IEEE Security & Privacy · doi:10.1109/msecp.2003.1203227 · Cited by 34 · see citing works
A Systemic Approach for Assessing Software Supply-Chain Risk
Alberts, C., Dorofee, A., Creel, R., Ellison, R. J., & Woody, C. (2011) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2011.36 · Cited by 33 · see citing works
Supply-Chain Risk Management: Incorporating Security into Software Development
Ellison, R. J., & Woody, C. (2010) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2010.355 · Cited by 32 · see citing works
Investigating The Reproducibility of NPM Packages
Goswami, P., Gupta, S., Li, Z., Meng, N., & Yao, D. (2020) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme46990.2020.00071 · Cited by 29 · see citing works
Identifying Challenges for OSS Vulnerability Scanners - A Study & Test Suite
Dann, A., Plate, H., Hermann, B., Ponta, S. E., & Bodden, E. (2021) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2021.3101739 · Cited by 28 · see citing works
Self-citationNeil, L., Mittal, S., & Joshi, A. (2018) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2018.8587375 · Cited by 27 · see citing works
Vulnerabilities in Continuous Delivery Pipelines? A Case Study
Paule, C., Düllmann, T. F., & van Hoorn, A. (2019) · IEEE International Conference on Software Architecture Companion (ICSA-C) · doi:10.1109/icsa-c.2019.00026 · Cited by 27 · see citing works
Challenges and implications of verifiable builds for security-critical open-source software
de Carnavalet, X. D. C., & Mannan, M. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664288 · Cited by 25 · see citing works
Information Security and Open Source Dual Use Security Software: Trust Paradox
Silić, M., & Bäck, A. (2013) · IFIP advances in information and communication technology · doi:10.1007/978-3-642-38928-3_14 · Cited by 24 · see citing works
Security of public continuous integration services
Gruhn, V., Hannebauer, C., & John, C. (2013) · International Symposium on Open Collaboration · doi:10.1145/2491055.2491070 · Cited by 24 · see citing works
Supply-Chain Vulnerability Elimination via Active Learning and Regeneration
Vasilakis, N., Benetopoulos, A., Handa, S., Schoen, A., Shen, J., & Rinard, M. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484736 · Cited by 24 · see citing works
A Global, Empirical Analysis of the Shellshock Vulnerability in Web Applications
Delamore, B., & Ko, R. K. L. (2015) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications / BigDataSE / ISPA (Trustcom/BigDataSE/ISPA) · doi:10.1109/trustcom.2015.493 · Cited by 20 · see citing works
Modeling Supply Chain Attacks in IEC 61850 Substations
Duman, O., Ghafouri, M., Kassouf, M., Atallah, R. F., Wang, L., & Debbabi, M. (2019) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2019.8909818 · Cited by 20 · see citing works
Security Issues in Language-based Sofware Ecosystems.Preprint
Vaidya, R. K., Carli, L. D., Davidson, D., & Rastogi, V. (2019) · arXiv (Cornell University) · Cited by 19 · see citing works
A Survey on Common Threats in npm and PyPi Registries
Kaplan, B., & Qian, J. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-87839-9_6 · Cited by 18 · see citing works
Assessing Attack Surface with Component-Based Package Dependency
Zhang, S., Zhang, X., Ou, X., Chen, L., Edwards, N., & Jin, J. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-25645-0_29 · Cited by 17 · see citing works
Current Taxonomy of Information Security Threats in Software Development Life Cycle
Barabanov, A., Markov, A. S., Иванович, Г. М., & Tsirlov, V. L. (2018) · IEEE International Conference on Application of Information and Communication Technologies (AICT) · doi:10.1109/icaict.2018.8747065 · Cited by 17 · see citing works
Torres-Arias, S., Ammula, A. K., Curtmola, R., & Cappos, J. (2016) · USENIX Security Symposium · Cited by 16 · see citing works
Trojan Source: Invisible VulnerabilitiesPreprint
Boucher, N., & Anderson, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.00169 · Cited by 14 · see citing works
Wright, C. (2008) · CERN Document Server (European Organization for Nuclear Research) · Cited by 13 · see citing works
Breaking Trust – Shades of Crisis Across an Insecure Software Supply Chain
Herr, T. (2021) · Cited by 13 · see citing works
Towards Measuring Supply Chain Attacks on Package Managers for Interpreted LanguagesPreprint
Duan, R., Alrawi, O., Kasturi, R. P., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.01139 · Cited by 13 · see citing works
Assessing software supply chain risk using public data
Benthall, S. (2017) · doi:10.1109/stc.2017.8234461 · Cited by 11 · see citing works
py2src: Towards the Automatic (and Reliable) Identification of Sources for PyPI Package
Vu, D. (2021) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678526 · Cited by 10 · see citing works
SpellBound: Defending Against Package TyposquattingPreprint
Taylor, M., Vaidya, R. K., Davidson, D., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.03471 · Cited by 10 · see citing works
Towards An Analysis of Software Supply Chain Risk Management
Du, S., Lu, T., Zhao, L., Xu, B., Guo, X., & Yang, H. (2013) · Lecture notes in computer science · Cited by 9 · see citing works
Yurtsevenler, F. E. (2026) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.21908303 · Cited by 9 · see citing works
Marjanović, J., Dalčeković, N., & Sladić, G. (2021) · doi:10.1145/3459960.3459973 · Cited by 8 · see citing works
Trust and tamper-proof software delivery
Naedele, M., & Koch, T. E. (2006) · doi:10.1145/1137627.1137636 · Cited by 7 · see citing works
ShIFt - Software Identity Framework for Global Software Delivery
Singi, K., Kaulgud, V., Bose, R. P. J. C., & Podder, S. (2019) · IEEE International Conference on Global Software Engineering (ICGSE) · doi:10.1109/icgse.2019.00032 · Cited by 7 · see citing works
Supply chain risk management - Understanding vulnerabilities in code you buy, build, or integrate
Croll, P. R. (2011) · 2020 IEEE International Systems Conference (SysCon) · doi:10.1109/syscon.2011.5929123 · Cited by 6 · see citing works
Supporting the Detection of Software Supply Chain Attacks through Unsupervised Signature GenerationPreprint
Ohm, M., Kempf, L., Boes, F., & Meier, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.02235 · Cited by 6 · see citing works
Dependencies: No Software is an Island
Tellnes, J. (2013) · Cited by 6 · see citing works
Assuring software and hardware security and integrity throughout the supply chain
Axelrod, C. W. (2011) · IEEE International Conference on Technologies for Homeland Security · doi:10.1109/ths.2011.6107848 · Cited by 5 · see citing works
Software distribution as a malware infection vector
Gröbert, F., Sadeghi, A., & Winandy, M. (2009) · International Conference for Internet Technology and Secured Transactions · doi:10.1109/icitst.2009.5402538 · Cited by 5 · see citing works
Windows Malware Binaries in C/C++ GitHub Repositories: Prevalence and Lessons Learned
Cholter, W. L., Elder, M., & Stalick, A. Q. (2021) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0010237904750484 · Cited by 4 · see citing works
I Know What You Imported Last Summer: A study of security threats in thePython ecosystemPreprint
Bagmar, A., Wedgwood, J., Levin, D., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.06301 · Cited by 4 · see citing works
2020 State of the Octoverse: Securing the World's SoftwarePreprint
Forsgren, N., Alberts, B., Backhouse, K., Baker, G., Ceccarelli, G., Jedamski, D., Kelly, S., & Sullivan, C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.10246 · Cited by 4 · see citing works
Giovanini, L., Oliveira, D. S., Sanchez, H. A., & Shands, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.16067 · Cited by 3 · see citing works
(2023) · Oxford University Press eBooks · doi:10.1093/oed/7202462049 · Cited by 1 · see citing works
Flagged first, then by citations
1 of the 94 references couldn’t be matched to a known paper.
Research works printed but not linked: 15
- C. Clancy, J. Ferraro, R. Martin, A. Pennington, C. Sledjeski, and C. Wiener, "Deliver uncompromised: Securing critical software supply chains," MITRE Technical Papers, vol. 24, 01 2021.
- Q. Wu and K. Lu, "On the feasibility of stealthily introducing vulnera- bilities in open-source software via hypocrite commits," Proc. Oakland, page to appear, 2021.
- I. Haddad and B. Warner, "Understanding the open source development model," Linux Journal, 2011.
- B. Schneier, "Attack trees," Dr. Dobb's journal, vol. 24, no. 12, pp. 21- 29, 1999.
- N. P. Tschacher, Typosquatting in programming language package managers. PhD thesis, Universität Hamburg, Fachbereich Informatik, 2016.
- A. Fass, M. Backes, and B. Stock, "Hidenoseek: Camouflaging ma- licious javascript in benign asts," in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, CCS '19, (New York, NY, USA), p. 1899-1913, Association for Computing Machinery, 2019.
- "An emergency re-review of kernel commits authored by members of the university of minnesota, due to the hypocrite commits research paper." https://lore.kernel.org/lkml/202105051005.49BFABCE@keesc ook/. [Accessed 15-Mar-2022].
- J. Pewny and T. Holz, "Evilcoder: Automated bug insertion," in Proceedings of the 32nd Annual Conference on Computer Security Applications, ACSAC '16, (New York, NY, USA), p. 214-225, As- sociation for Computing Machinery, 2016.
- W. Goerigk, "On trojan horses in compiler implementations," in Proc. des Workshops Sicherheit und Zuverlassigkeit softwarebasierter Systeme, Citeseer, 1999.
- K. Garrett, G. P. Ferreira, L. Jia, J. Sunshine, and C. Kästner, "Detect- ing suspicious package updates," 2019 IEEE/ACM 41st International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER), pp. 13-16, 2019.
- T. K. Kuppusamy, S. Torres-Arias, V. Diaz, and J. Cappos, "Diplomat: Using delegations to protect community repositories," in Proceedings of the 13th Usenix Conference on Networked Systems Design and Implementation, NSDI'16, (USA), p. 567-581, USENIX Association, 2016.
- K. Alhamed, M. C. Silaghi, I. Hussien, and Y. Yang, "Security by de- centralized certification of automatic-updates for open source software controlled by volunteers," in Workshop on Decentralized Coordination, Citeseer, 2013.
- B. Lamowski, C. Weinhold, A. Lackorzynski, and H. Härtig, "Sand- crust: Automatic sandboxing of unsafe components in rust," in Proceed- ings of the 9th Workshop on Programming Languages and Operating Systems, PLOS'17, (New York, NY, USA), p. 51-57, Association for Computing Machinery, 2017.
- R. Goyal, G. Ferreira, C. Kästner, and J. Herbsleb, "Identifying unusual commits on github: Goyal et al .," Journal of Software: Evolution and Process, vol. 30, p. e1893, 09 2017.
- D. Wheeler, "Countering trusting trust through diverse double- compiling," in 21st Annual Computer Security Applications Conference (ACSAC'05), pp. 13 pp.-48, 2005.
Cited by
Sorted by citations
Research Directions in Software Supply Chain Security
Williams, L. A., Benedetti, G., Hamer, S., Paramitha, R., Rahman, I., Tamanna, M., Tystahl, G., Zahan, N., Morrison, P. J., Acar, Y., et al. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3714464 · Cited by 74 · see citing works
An Empirical Study of Malicious Code In PyPI Ecosystem
Guo, W., Xu, Z., Liu, C., Huang, C., Fang, Y., & Liu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00135 · Cited by 53 · see citing works
Cob-Parro, A. C., Lalangui, Y., & Lazcano, R. (2024) · Agronomy · doi:10.3390/agronomy14020259 · Cited by 41 · see citing works
Challenges of Producing Software Bill of Materials for Java
Balliu, M., Baudry, B., Bobadilla, S., Ekstedt, M., Monperrus, M., Ron, J., Sharma, A., Skoglund, G., Soto-Valero, C., & Wittlinger, M. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3302956 · Cited by 42 · see citing works
Wani, M. S., Kretschmer, M., Schröder, B., Grebe, A., & Rademacher, M. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3430823 · Cited by 44 · see citing works
Zhang, J.-N., Huang, K.-F., Huang, Y.-H., Chen, B., Wang, R., Wang, C., & Peng, X. (2023) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3705304 · Cited by 69 · see citing works
Hamer, S., d’Amorim, M., & Williams, L. A. (2024) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw63631.2024.00014 · Cited by 37 · see citing works
Maltracker: A Fine-Grained NPM Malware Tracker Copiloted by LLM-Enhanced Dataset
Yu, Z., Wen, M., Guo, X., & Jin, H. (2024) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3650212.3680397 · Cited by 33 · see citing works
On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI
Ladisa, P., Ponta, S. E., Ronzoni, N., Martínez, M., & Barais, O. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627138 · Cited by 30 · see citing works
Self-citationOn the Way to SBOMs: Investigating Design Issues and Solutions in Practice
Bi, T., Xia, B., Xing, Z., Lu, Q., & Zhu, L. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3654442 · Cited by 31 · see citing works
An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures
Singla, T., Anandayuvaraj, D., Kalu, K. G., Schorlemmer, T. R., & Davis, J. C. (2023) · Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses · doi:10.1145/3605770.3625214 · Cited by 26 · see citing works
Shadows in the Interface: A Comprehensive Study on Dark Patterns
Nie, L., Zhao, Y., Li, C., Luo, X., & Liu, Y. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643736 · Cited by 26 · see citing works
Bad Snakes: Understanding and Improving Python Package Index Malware Scanning
Vu, D., Newman, Z., & Meyers, J. S. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00052 · Cited by 25 · see citing works
A Needle is an Outlier in a Haystack: Hunting Malicious PyPI Packages with Code Clustering
Liang, W., Ling, X. G., Wu, J., Luo, T., & Wu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00085 · Cited by 22 · see citing works
"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain
Wermke, D., Klemmer, J. H., Wöhler, N., Schmüser, J., Ramulu, H. S., Acar, Y., & Fahl, S. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179378 · Cited by 21 · see citing works
Towards the Detection of Malicious Java Packages
Ladisa, P., Plate, H., Martínez, M., Barais, O., & Ponta, S. E. (2022) · doi:10.1145/3560835.3564548 · Cited by 19 · see citing works
Self-citationRisk Explorer for Software Supply Chains
Ladisa, P., Plate, H., Martínez, M., Barais, O., & Ponta, S. E. (2022) · doi:10.1145/3560835.3564546 · Cited by 18 · see citing works
Self-citationPTMTorrent: A Dataset for Mining Open-source Pre-trained Model Packages
Jiang, W., Synovic, N. M., Jajal, P., Schorlemmer, T. R., Tewari, A., Pareek, B., Thiruvathukal, G. K., & Davis, J. C. (2023) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr59073.2023.00021 · Cited by 17 · see citing works
Models Are Codes: Towards Measuring Malicious Code Poisoning Attacks on Pre-trained Model Hubs
Zhao, J., Wang, S., Zhao, Y., Hou, X., Wang, K., Gao, P., Zhang, Y., Wei, C., & Wang, H. (2024) · Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering · doi:10.1145/3691620.3695271 · Cited by 16 · see citing works
Zheng, X., Wei, C., Wang, S., Zhao, Y., Gao, P., Zhang, Y., Wang, K., & Wang, H. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695262 · Cited by 16 · see citing works
Intelligent detection for Polycystic Ovary Syndrome (PCOS): Taxonomy, datasets and detection tools
Li, M., He, Z. S., Shi, L., Lin, M., Li, M., Cheng, Y., Liu, H., Xue, L., Said, K. S., Yusuf, M., et al. (2025) · Computational and Structural Biotechnology Journal · doi:10.1016/j.csbj.2025.04.011 · Cited by 14 · see citing works
SBOM Ouverture: What We Need and What We Have
Dalia, G., Visaggio, C. A., Sorbo, A. D., & Canfora, G. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3669975 · Cited by 14 · see citing works
Klivan, S., Höltervennhoff, S., Panskus, R., Marky, K., & Fahl, S. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00214 · Cited by 13 · see citing works
Huang, Y., Wang, R., Zheng, W. H., Zhou, Z., Wu, S., Ke, S., Chen, B., Gao, S., & Peng, X. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695492 · Cited by 13 · see citing works
SoK: Software Compartmentalization
Lefeuvre, H., Dautenhahn, N., Chisnall, D., & Olivier, P. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00075 · Cited by 17 · see citing works
Understanding the Response to Open-Source Dependency Abandonment in the npm Ecosystem
Miller, C., Jahanshahi, M., Mockus, A., Vasilescu, B., & Kästner, C. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00004 · Cited by 12 · see citing works
Automatically Generating Rules of Malicious Software Packages via Large Language Model
Zhang, X., Du, X., Chen, H., He, Y., Niu, W., & Li, Y. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00072 · Cited by 12 · see citing works
Journey to the Center of Software Supply Chain Attacks
Ladisa, P., Ponta, S. E., Sabetta, A., Martínez, M., & Barais, O. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3302066 · Cited by 11 · see citing works
Self-citationMalPacDetector: An LLM-Based Malicious NPM Package Detector
Wang, J., Li, Z., Qu, J., Zou, D., Xu, S., Xu, Z., Wang, Z., & Jin, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3580336 · Cited by 11 · see citing works
Software supply chain security: a systematic literature review
Reichert, B. M., & Obelheiro, R. R. (2024) · International Journal of Computers and Applications · doi:10.1080/1206212x.2024.2390978 · Cited by 13 · see citing works
X-Ray-TLS: Transparent Decryption of TLS Sessions by Extracting Session Keys from Memory
Moriconi, F., Levillain, O., Francillon, A., & Raphaël Troncy, A. (2024) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3634737.3637654 · Cited by 9 · see citing works
He, H., Vasilescu, B., & Kästner, C. (2025) · Proceedings of the ACM on software engineering. · doi:10.1145/3715728 · Cited by 10 · see citing works
SoK: On the Offensive Potential of AI
Schröer, S. L., Apruzzese, G., Human, S., Laskov, P., Anderson, H. S., Bernroider, E. W. N., Fass, A., Nassi, B., Rimmer, V., Roli, F., et al. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00021 · Cited by 10 · see citing works
Construction of Software Supply Chain Threat Portrait Based on Chain Perspective
Wang, M., Wu, P., & Luo, Q. (2023) · Mathematics · doi:10.3390/math11234856 · Cited by 9 · see citing works
Gao, K., Xu, W., Yang, W., & Zhou, M. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3660822 · Cited by 8 · see citing works
Elastic Cross-Layer Orchestration of Network Policies in the Kubernetes Stack
Budigiri, G., Baumann, C., Truyen, E., & Joosen, W. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3531040 · Cited by 8 · see citing works
IoT systems testing: Taxonomy, empirical findings, and recommendations
Minani, J. B., Fellah, Y. E., Sabir, F., Moha, N., Guéhéneuc, Y., Kuradusenge, M., & Masuda, T. (2025) · Journal of Systems and Software · doi:10.1016/j.jss.2025.112408 · Cited by 11 · see citing works
Alshammari, B., & Singh, M. M. (2025) · IEEE Access · doi:10.1109/access.2025.3552689 · Cited by 8 · see citing works
Decomposing and Measuring Trust in Open-Source Software Supply Chains
Boughton, L., Miller, C., Acar, Y., Wermke, D., & Kästner, C. (2024) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1145/3639476.3639775 · Cited by 8 · see citing works
Developers' Approaches to Software Supply Chain Security: An Interview Study
Sammak, R., Rotthaler, A. L., Ramulu, H. S., Wermke, D., & Acar, Y. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3689944.3696160 · Cited by 8 · see citing works
Benedetti, G., Cofano, S., Brighente, A., & Conti, M. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95764-2_19 · Cited by 7 · see citing works
An Empirical Study on Reproducible Packaging in Open-Source Ecosystems
Benedetti, G., Solarin, O., Miller, C., Tystahl, G., Enck, W., Kästner, C., Kapravelos, A., Merlo, A., & Verderame, L. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00136 · Cited by 7 · see citing works
RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains
Sofaer, R. J., David, Y., Kang, M., Yu, J., Cao, Y., Yang, J., & Nieh, J. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3639199 · Cited by 7 · see citing works
On the Impact of Refactorings on Software Attack Surface
Edward, E., Nyamawe, A. S., & Elisa, N. (2024) · IEEE Access · doi:10.1109/access.2024.3404058 · Cited by 7 · see citing works
Software Supply Chain Risk Assessment Framework
Zahan, N. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion58688.2023.00068 · Cited by 7 · see citing works
A Viewpoint on Human Factors in Software Supply Chain Security: A Research Agenda
Fourné, M., Wermke, D., Fahl, S., & Acar, Y. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3316569 · Cited by 7 · see citing works
Speranza: Usable, Privacy-friendly Software Signing
Merrill, K., Newman, Z., Torres-Arias, S., & Sollins, K. R. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623200 · Cited by 7 · see citing works
SoK: Security and Privacy of Blockchain InteroperabilityPreprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2023) · doi:10.36227/techrxiv.24595764 · Cited by 7 · see citing works
SoK: Security and Privacy of Blockchain Interoperability [Extended Version]Preprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2024) · doi:10.36227/techrxiv.24595764.v4 · Cited by 6 · see citing works
CHERIoT RTOS: An OS for Fine-Grained Memory-Safe Compartments on Low-Cost Embedded Devices
Amar, S., Chen, T., Chisnall, D., Filardo, N. W., Laurie, B., Lefeuvre, H., Liu, K., Moore, S. W., Norton-Wright, R., Seltzer, M., et al. (2025) · ACM SIGOPS Symposium on Operating Systems Principles (SOSP) · doi:10.1145/3731569.3764844 · Cited by 5 · see citing works
Closing the Chain: How to reduce your risk of being SolarWinds, Log4j, or XZ Utils
Hamer, S., Bowen, J., Haque, M. N., Hines, R., Madden, C., & Williams, L. A. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773194 · Cited by 6 · see citing works
$ZTD_{\text{JAVA}}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies
Amusuo, P. C., Robinson, K. A., Singla, T., Peng, H., Machiry, A., Torres-Arias, S., Simon, L., & Davis, J. C. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00148 · Cited by 7 · see citing works
An Analysis of Malicious Packages in Open-Source Software in the Wild
Zhou, X., Zhang, Y., Niu, W., Liu, J., Wang, H., & Li, Q. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00045 · Cited by 5 · see citing works
Anjum, N., Sakib, N., Rodriguez-Cardenas, J., Brookins, C., Norouzinia, A., Shavers, A., Dominguez, M., Nassif, M., & Shahriar, H. (2023) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac57700.2023.00281 · Cited by 5 · see citing works
SoK: A Taxonomic Analysis of DeFi Rug Pulls: Types, Dataset, and Tool Assessment
Sun, D., Ma, W., Nie, L., & Liu, Y. (2025) · Proceedings of the ACM on software engineering. · doi:10.1145/3728900 · Cited by 17 · see citing works
Are Your Dependencies Code Reviewed?: Measuring Code Review Coverage in Dependency Updates
Imtiaz, N., & Williams, L. A. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3319509 · Cited by 4 · see citing works
Extending The Update Framework (TUF) for Industrial Control System Applications
Romansky, B., Mazzuchi, T. A., & Sarkani, S. (2024) · IEEE SoutheastCon · doi:10.1109/southeastcon52093.2024.10500028 · Cited by 4 · see citing works
Yang, L., Zhang, H., Xu, J., Lyu, J., Zhou, X., Shao, D., Gao, S., & Bacchelli, A. (2024) · Empirical Software Engineering · doi:10.1007/s10664-024-10526-9 · Cited by 4 · see citing works
Exploring the Landscape of Programming Language Identification With Machine Learning Approaches
Verma, A., Saha, R., Kumar, G., Brighente, A., Conti, M., & Kim, T.-H. (2025) · IEEE Access · doi:10.1109/access.2025.3538108 · Cited by 4 · see citing works
Hamer, S., Imtiaz, N., Tamanna, M., Shabrina, P., & Williams, L. A. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3551664 · Cited by 4 · see citing works
Artemis: Defanging Software Supply Chain Attacks in Multi-repository Update Systems
Moore, M., Kuppusamy, T. K., & Cappos, J. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627129 · Cited by 4 · see citing works
Detecting Python Malware in the Software Supply Chain with Program Analysis
Shariffdeen, R., Hassanshahi, B., Мирчев, М., Husseini, A. E., & Roychoudhury, A. (2025) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip66354.2025.00024 · Cited by 4 · see citing works
SoK: Security and Privacy of Blockchain InteroperabilityPreprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2023) · doi:10.36227/techrxiv.24595764.v1 · Cited by 4 · see citing works
Exposing the Hidden Layer: Software Repositories in the Service of Seo Manipulation
Wu, M., Hong, G., Mai, W., Wu, X., Zhang, L., Pu, Y., Chai, H., Ying, L., Duan, H., & Yang, M. (2025) · 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE) · doi:10.1109/icse55347.2025.00147 · Cited by 3 · see citing works
Establishing Provenance Before Coding: Traditional and Next-Generation Software Signing
Schorlemmer, T. R., Burmane, E. H., Kalu, K. G., Torres-Arias, S., & Davis, J. C. (2025) · IEEE Security & Privacy · doi:10.1109/msec.2025.3537616 · Cited by 3 · see citing works
Akhoundali, J., Hamidi, H., Rietveld, K. F. D., & Gadyatskaya, O. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3736220 · Cited by 3 · see citing works
Wolf in Sheep’s Clothing: Shearing the Camouflage of Malicious Java Components in Maven
Zeng, Y., Huang, C., Han, J., Zhao, J., Wang, N., Liang, G., & Jiang, S. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3599732 · Cited by 3 · see citing works
Jin, Z., Lu, X., Yang, B., Cheng, Y., Yan, C., Ji, X., & Xu, W. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645612 · Cited by 3 · see citing works
Integrating Artificial Open Generative Artificial Intelligence into Software Supply Chain Security
Alevizos, V., Papakostas, G. A., Simasiku, A., Malliarou, D., Messinis, A., Edralin, S., Xu, C., & Yue, Z. (2024) · International Conference on Data Analytics for Business and Industry (ICDABI) · doi:10.1109/icdabi63787.2024.10800301 · Cited by 4 · see citing works
Jiang, W., Çakar, B., Lysenko, M., & Davis, J. C. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773229 · Cited by 3 · see citing works
Assessing the Real Impact of Open-Source Components in Software Systems
Molin, A., Riviş, A. M., & Marinescu, R. (2023) · IEEE Access · doi:10.1109/access.2023.3322362 · Cited by 3 · see citing works
A Viewpoint on Software Supply Chain Security: Are We Getting Lost in Translation?
Melara, M. S., & Torres-Arias, S. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3316568 · Cited by 3 · see citing works
A Knowledge-driven Framework for Software Supply Chain Security Analysis
Sun, Z., Quan, Z., Yu, S., Zhang, L., & Mao, D. (2024) · International Conference on Control Engineering and Artificial Intelligence (CCEAI) · doi:10.1145/3640824.3640866 · Cited by 3 · see citing works
SoK: Intelligent Detection for Polycystic Ovary Syndrome(PCOS)Preprint
Li, M., He, Z. S., Nie, L., Shi, L., Lin, M., Li, M., Cheng, Y., Liu, H., & Xue, L. (2024) · medRxiv · doi:10.1101/2024.12.25.24319623 · Cited by 3 · see citing works
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 2 · see citing works
A Machine Learning-Based Approach For Detecting Malicious PyPI Packages
Sammaneh, H., Costa, D. E., Shihab, E., & Abdellatif, A. (2025) · ACM Symposium on Applied Computing · doi:10.1145/3672608.3707756 · Cited by 2 · see citing works
PuRe Defender: A Game-Theoretic Pull Request Assignment with Deep RL
Koushyar, J. M., Guirguis, M., & Atia, G. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-08064-6_10 · Cited by 2 · see citing works
Towards Socio-Technical Topology-Aware Adaptive Threat Detection in Software Supply Chains
Welsh, T., Finnsson, K., Stefáansson, B., & Neukirchen, H. (2025) · International Conference on Social Networks Analysis, Management and Security (SNAMS) · doi:10.1109/snams67467.2025.11391209 · Cited by 2 · see citing works
Syed, T. A., Belgaum, M. R., Jan, S., Khan, A. A., & Alqahtany, S. S. (2025) · International Conference on Computer and Applications (ICCA) · doi:10.1109/icca66035.2025.11430751 · Cited by 4 · see citing works
Major milestone in open source security
issues, C., & Markov, A. (2023) · Voprosy kiberbezopasnosti · doi:10.21681/2311-3456-2023-1-2-12 · Cited by 2 · see citing works
Software Bill of Materials in Java
Balliu, M., Baudry, B., Bobadilla, S., Ekstedt, M., Monperrus, M., Ron, J., Sharma, A., Skoglund, G., Soto-Valero, C., & Wittlinger, M. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3605770.3625207 · Cited by 2 · see citing works
Heinl, M. P., & Embacher, V. (2024) · ACM Workshop on CPS&IoT Security and Privacy (CPSIoTSec) · doi:10.1145/3690134.3694816 · Cited by 2 · see citing works
An Analysis of Malicious Behaviors of Open-Source Packages Using Dynamic Analysis
Nguyen, T.-C., Vu, D., & Debnath, N. C. (2024) · Communications in computer and information science · doi:10.1007/978-3-031-76273-4_8 · Cited by 2 · see citing works
Study of Attacks on the HHL Quantum Algorithm
Tan, Y., Kukina, H., & Szefer, J. M. (2024) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa62245.2024.00064 · Cited by 2 · see citing works
Zhang, G., Yao, T., Qin, J., Li, Y., Ma, Q., & Sun, D. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.103973 · Cited by 2 · see citing works
Zhang, S., Ma, J., Bai, H., Ren, Y., Jia, N., & Hu, X. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858537 · Cited by 2 · see citing works
Iqbal, T., Wu, G., Iqbal, Z., Mahmood, M. B., Shafique, A., & Guo, W. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104032 · Cited by 2 · see citing works
MatriXSSed: A New Taxonomy for XSS in the Modern Web
Somé, D. F. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3696410.3714774 · Cited by 2 · see citing works
Dirty-Waters: Detecting Software Supply Chain Smells
Liu, R., Bobadilla, S., Baudry, B., & Monperrus, M. (2025) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3696630.3728578 · Cited by 2 · see citing works
What Can Self-Admitted Technical Debt Tell Us About Security? A Mixed-Methods StudyPreprint
Ferreyra, N. E. D., Shahin, M., Zahedi, M., Quadri, S., & Scandariato, R. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2401.12768 · Cited by 2 · see citing works
SoK: Security and Privacy of Blockchain Interoperability [Extended Version]Preprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2024) · doi:10.36227/techrxiv.24595764.v2 · Cited by 2 · see citing works
Issues in the Implementation of Secure Software Development Processes
Markov, A. S., Varenitca, V. V., & Arustamyan, S. S. (2023) · Seminar on Information Systems Theory and Practice (ISTP) · doi:10.1109/istp60767.2023.10427367 · Cited by 1 · see citing works
More Haste, Less Speed: Cache Related Security Threats in Continuous Integration Services
Gu, Y., Ying, L., Chai, H., Pu, Y., Duan, H., & Gao, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00138 · Cited by 1 · see citing works
AdapSan: Adaptive Input Sanitization in Medical Systems with eBPF
Chang, S., Li, A., Jaff, E., Chang, Y., Wang, J., Zhang, N., & Hsiao, H. (2024) · doi:10.1145/3689935.3690397 · Cited by 1 · see citing works
Test Suites Guided Vulnerability Validation for Node.js Applications
Luo, C., Li, P., Meng, W., & Zhang, C. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690332 · Cited by 1 · see citing works
AAF-SCM: An Authenticated Framework for Supply Chain Management
Roy, P., Kumar, R., & Morshed, M. N. (2024) · International Conference on Intelligent Systems and Advanced Applications (ICISAA) · doi:10.1109/icisaa62385.2024.10829139 · Cited by 1 · see citing works
Analysis of Supply Chain Attacks in Open-Source Software and Mitigation Strategies
Merigala, J., Kumar, V., Gujjarlapudi, J., Gupta, M., & Kumar, A. (2024) · International Conference on Communication, Computing and Industry 4.0 (C2I4) · doi:10.1109/c2i663243.2024.10895136 · Cited by 1 · see citing works
Who's Pushing the Code? An Exploration of GitHub Impersonation
Zhang, Y., Liang, A., Wang, X., Wiśniewski, P., Zhang, F., Leach, K., & Huang, Y. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00065 · Cited by 1 · see citing works
POSTER:TYPOSQUATTING ATTACKS ON THE RUST ECOSYSTEM
Vu, M.-K., Nguyen, T.-C., & Vu, D. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3735340 · Cited by 1 · see citing works
- Authors
- Ladisa, P., Plate, H., Martinez, M., & Barais, O.
- Affiliations
- Systems, Applications & Products in Data Processing (Switzerland) (CH)
- Université Polytechnique Hauts-de-France
- Institut national de recherche en sciences et technologies du numérique (FR)
- Venue
- 2023 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2023-05
- Pages
- 1509-1526
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W4385208592
- Cited by
- 208
- References
- 94
- Citations by year
- 2026: 65 · 2025: 63 · 2024: 46 · 2023: 32 · 2022: 2
- FWCI
- 52.94
- Type
- conference paper
- Language
- en
- Open access
- green
- inria.hal.science
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- HAL (submittedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- attack taxonomy, supply chain attacks, malicious code injection, attack trees, software supply chain security, security measures, developer survey, attack vectors
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
