The DOI matches its Crossref record; 93 of the 94 references it cites were found in a registry or an index.
SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Open accessAbstract
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today’s open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims.This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“PQC transition affects all three due to increased key sizes, larger signature sizes, and hybrid mode requirements during the transition period [17,18].”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“IETF drafts for hybrid key exchange [17,18], PQC certificate profiles, and composite signature formats are still in progress.”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Systematic Literature Reviews in Software Engineering—A Systematic Literature Review
Kitchenham, B., Pearl Brereton, O., Budgen, D., Turner, M., Bailey, J., & Linkman, S. (2009) · Information and Software Technology · doi:10.1016/j.infsof.2008.09.009 · Cited by 4,537
Experimentation in Software Engineering
Wohlin, C., Runeson, P., Höst, M., Ohlsson, M. C., Regnell, B., & Wesslén, A. (2012) · doi:10.1007/978-3-642-29044-2 · Cited by 4,460
Goodman, L. A. (1961) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177705148 · Cited by 3,606
2017 USENIX Annual Technical Conference (USENIX ATC'17)
Quoc, D. L., Beck, M. S., Bhatotia, P., Chen, R., Fetzer, C. W., & Strufe, T. (2017) · Cited by 3,091
Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J. G., Payer, M., Weaver, N., Adrian, D., Paxson, V., Bailey, M., et al. (2014) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2663716.2663755 · Cited by 692
Thompson, K. (1984) · Communications of the ACM · doi:10.1145/358198.358210 · Cited by 670
Malware Obfuscation Techniques: A Brief Survey
You, I., & Yim, K. (2010) · 2010 International Conference on Broadband, Wireless Computing, Communication and Applications · doi:10.1109/bwcca.2010.85 · Cited by 607
Mauw, S., & Oostdijk, M. (2006) · Lecture notes in computer science · doi:10.1007/11734727_17 · Cited by 504
(2008) · doi:10.1016/b978-0-12-373558-4.x0001-5 · Cited by 287
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-52683-2_2 · Cited by 259
Self-citation
Research works printed but not linked: 19
- Clancy, 2021, Deliver uncompromised: Securing critical software supply chains, MITRE Technical Papers, 24
- Wu, On the feasibility of stealthily introducing vulnerabilities in open-source software via hypocrite commits
- Haddad, 2011, Understanding the open source development model, Linux Journal
- Cox, 2019, Our software dependency problem
- Schneier, 1999, Attack trees, Dr. Dobb’s journal, 24, 21
- Spencer, 2009, Card sorting: Designing usable categories
- Du, Towards an analysis of software supply chain risk management, 1
- Tschacher, 2016, Typosquatting in programming language package managers
- An emergency re-review of kernel commits authored by members of the university of minnesota, due to the hypocrite commits research paper
- Kuppusamy, Mercury: Bandwidth-effective prevention of rollback attacks against community repositories, 673
- McClure, 2010, Protecting your critical assets-lessons learned from operation aurora, Tech. Rep.
- Goerigk, On trojan horses in compiler implementations
- Kuppusamy, Diplomat: Using delegations to protect community repositories, 567
- Alhamed, Security by decentralized certification of automatic-updates for open source software controlled by volunteers
- Almubayed, 2019, Practical approach to automate the discovery and eradication of opensource software vulnerabilities at scale, Blackhat USA
- 10.1007/978-3-030-65745-1_7 · DOI
- Lamowski, Sand-crust: Automatic sandboxing of unsafe components in rust, 51
- 10.1002/smr.1893 · DOI
- 10.1109/CSAC.2005.17 · DOI
Cited by
Sorted by citations
Research Directions in Software Supply Chain Security
Williams, L. A., Benedetti, G., Hamer, S., Paramitha, R., Rahman, I., Tamanna, M., Tystahl, G., Zahan, N., Morrison, P. J., Acar, Y., et al. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3714464 · Cited by 111
An Empirical Study of Malicious Code In PyPI Ecosystem
Guo, W., Xu, Z., Liu, C., Huang, C., Fang, Y., & Liu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00135 · Cited by 53
Cob-Parro, A. C., Lalangui, Y., & Lazcano, R. (2024) · Agronomy · doi:10.3390/agronomy14020259 · Cited by 41
Challenges of Producing Software Bill of Materials for Java
Balliu, M., Baudry, B., Bobadilla, S., Ekstedt, M., Monperrus, M., Ron, J., Sharma, A., Skoglund, G., Soto-Valero, C., & Wittlinger, M. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3302956 · Cited by 42
Wani, M. S., Kretschmer, M., Schröder, B., Grebe, A., & Rademacher, M. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3430823 · Cited by 44
Zhang, J.-N., Huang, K.-F., Huang, Y.-H., Chen, B., Wang, R., Wang, C., & Peng, X. (2023) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3705304 · Cited by 69
Hamer, S., d’Amorim, M., & Williams, L. A. (2024) · IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw63631.2024.00014 · Cited by 52
Maltracker: A Fine-Grained NPM Malware Tracker Copiloted by LLM-Enhanced Dataset
Yu, Z., Wen, M., Guo, X., & Jin, H. (2024) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3650212.3680397 · Cited by 42
On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI
Ladisa, P., Ponta, S. E., Ronzoni, N., Martínez, M., & Barais, O. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627138 · Cited by 30
Self-citationOn the Way to SBOMs: Investigating Design Issues and Solutions in Practice
Bi, T., Xia, B., Xing, Z., Lu, Q., & Zhu, L. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3654442 · Cited by 31
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 28
An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures
Singla, T., Anandayuvaraj, D., Kalu, K. G., Schorlemmer, T. R., & Davis, J. C. (2023) · Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses · doi:10.1145/3605770.3625214 · Cited by 26
Shadows in the Interface: A Comprehensive Study on Dark Patterns
Nie, L., Zhao, Y., Li, C., Luo, X., & Liu, Y. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3643736 · Cited by 26
Bad Snakes: Understanding and Improving Python Package Index Malware Scanning
Vu, D., Newman, Z., & Meyers, J. S. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00052 · Cited by 25
A Needle is an Outlier in a Haystack: Hunting Malicious PyPI Packages with Code Clustering
Liang, W., Ling, X. G., Wu, J., Luo, T., & Wu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00085 · Cited by 22
"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain
Wermke, D., Klemmer, J. H., Wöhler, N., Schmüser, J., Ramulu, H. S., Acar, Y., & Fahl, S. (2023) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46215.2023.10179378 · Cited by 21
Towards the Detection of Malicious Java Packages
Ladisa, P., Plate, H., Martínez, M., Barais, O., & Ponta, S. E. (2022) · doi:10.1145/3560835.3564548 · Cited by 19
Self-citationRisk Explorer for Software Supply Chains
Ladisa, P., Plate, H., Martínez, M., Barais, O., & Ponta, S. E. (2022) · doi:10.1145/3560835.3564546 · Cited by 18
Self-citationPTMTorrent: A Dataset for Mining Open-source Pre-trained Model Packages
Jiang, W., Synovic, N. M., Jajal, P., Schorlemmer, T. R., Tewari, A., Pareek, B., Thiruvathukal, G. K., & Davis, J. C. (2023) · International Conference on Mining Software Repositories (MSR) · doi:10.1109/msr59073.2023.00021 · Cited by 17
Models Are Codes: Towards Measuring Malicious Code Poisoning Attacks on Pre-trained Model Hubs
Zhao, J., Wang, S., Zhao, Y., Hou, X., Wang, K., Gao, P., Zhang, Y., Wei, C., & Wang, H. (2024) · Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering · doi:10.1145/3691620.3695271 · Cited by 16
Zheng, X., Wei, C., Wang, S., Zhao, Y., Gao, P., Zhang, Y., Wang, K., & Wang, H. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695262 · Cited by 16
Intelligent detection for Polycystic Ovary Syndrome (PCOS): Taxonomy, datasets and detection tools
Li, M., He, Z. S., Shi, L., Lin, M., Li, M., Cheng, Y., Liu, H., Xue, L., Said, K. S., Yusuf, M., et al. (2025) · Computational and Structural Biotechnology Journal · doi:10.1016/j.csbj.2025.04.011 · Cited by 14
SBOM Ouverture: What We Need and What We Have
Dalia, G., Visaggio, C. A., Sorbo, A. D., & Canfora, G. (2024) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3664476.3669975 · Cited by 14
Klivan, S., Höltervennhoff, S., Panskus, R., Marky, K., & Fahl, S. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00214 · Cited by 13
Huang, Y., Wang, R., Zheng, W. H., Zhou, Z., Wu, S., Ke, S., Chen, B., Gao, S., & Peng, X. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695492 · Cited by 13
SoK: Software Compartmentalization
Lefeuvre, H., Dautenhahn, N., Chisnall, D., & Olivier, P. (2025) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp61157.2025.00075 · Cited by 17
Understanding the Response to Open-Source Dependency Abandonment in the npm Ecosystem
Miller, C., Jahanshahi, M., Mockus, A., Vasilescu, B., & Kästner, C. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00004 · Cited by 18
Automatically Generating Rules of Malicious Software Packages via Large Language Model
Zhang, X., Du, X., Chen, H., He, Y., Niu, W., & Li, Y. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00072 · Cited by 12
Journey to the Center of Software Supply Chain Attacks
Ladisa, P., Ponta, S. E., Sabetta, A., Martínez, M., & Barais, O. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3302066 · Cited by 11
Self-citationMalPacDetector: An LLM-Based Malicious NPM Package Detector
Wang, J., Li, Z., Qu, J., Zou, D., Xu, S., Xu, Z., Wang, Z., & Jin, H. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3580336 · Cited by 11
Software supply chain security: a systematic literature review
Reichert, B. M., & Obelheiro, R. R. (2024) · International Journal of Computers and Applications · doi:10.1080/1206212x.2024.2390978 · Cited by 13
X-Ray-TLS: Transparent Decryption of TLS Sessions by Extracting Session Keys from Memory
Moriconi, F., Levillain, O., Francillon, A., & Raphaël Troncy, A. (2024) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3634737.3637654 · Cited by 9
He, H., Vasilescu, B., & Kästner, C. (2025) · Proceedings of the ACM on software engineering. · doi:10.1145/3715728 · Cited by 10
SoK: On the Offensive Potential of AI
Schröer, S. L., Apruzzese, G., Human, S., Laskov, P., Anderson, H. S., Bernroider, E. W. N., Fass, A., Nassi, B., Rimmer, V., Roli, F., et al. (2025) · IEEE Conference on Secure and Trustworthy Machine Learning (SaTML) · doi:10.1109/satml64287.2025.00021 · Cited by 17
Construction of Software Supply Chain Threat Portrait Based on Chain Perspective
Wang, M., Wu, P., & Luo, Q. (2023) · Mathematics · doi:10.3390/math11234856 · Cited by 9
Gao, K., Xu, W., Yang, W., & Zhou, M. (2024) · Proceedings of the ACM on software engineering. · doi:10.1145/3660822 · Cited by 16
Elastic Cross-Layer Orchestration of Network Policies in the Kubernetes Stack
Budigiri, G., Baumann, C., Truyen, E., & Joosen, W. (2025) · IEEE Transactions on Network and Service Management · doi:10.1109/tnsm.2025.3531040 · Cited by 8
IoT systems testing: Taxonomy, empirical findings, and recommendations
Minani, J. B., Fellah, Y. E., Sabir, F., Moha, N., Guéhéneuc, Y., Kuradusenge, M., & Masuda, T. (2025) · Journal of Systems and Software · doi:10.1016/j.jss.2025.112408 · Cited by 11
Alshammari, B., & Singh, M. M. (2025) · IEEE Access · doi:10.1109/access.2025.3552689 · Cited by 8
Decomposing and Measuring Trust in Open-Source Software Supply Chains
Boughton, L., Miller, C., Acar, Y., Wermke, D., & Kästner, C. (2024) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1145/3639476.3639775 · Cited by 8
Developers' Approaches to Software Supply Chain Security: An Interview Study
Sammak, R., Rotthaler, A. L., Ramulu, H. S., Wermke, D., & Acar, Y. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3689944.3696160 · Cited by 8
Benedetti, G., Cofano, S., Brighente, A., & Conti, M. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-95764-2_19 · Cited by 7
An Empirical Study on Reproducible Packaging in Open-Source Ecosystems
Benedetti, G., Solarin, O., Miller, C., Tystahl, G., Enck, W., Kästner, C., Kapravelos, A., Merlo, A., & Verderame, L. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00136 · Cited by 7
RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains
Sofaer, R. J., David, Y., Kang, M., Yu, J., Cao, Y., Yang, J., & Nieh, J. (2024) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3597503.3639199 · Cited by 7
On the Impact of Refactorings on Software Attack Surface
Edward, E., Nyamawe, A. S., & Elisa, N. (2024) · IEEE Access · doi:10.1109/access.2024.3404058 · Cited by 7
Software Supply Chain Risk Assessment Framework
Zahan, N. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion58688.2023.00068 · Cited by 7
A Viewpoint on Human Factors in Software Supply Chain Security: A Research Agenda
Fourné, M., Wermke, D., Fahl, S., & Acar, Y. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3316569 · Cited by 7
Speranza: Usable, Privacy-friendly Software Signing
Merrill, K., Newman, Z., Torres-Arias, S., & Sollins, K. R. (2023) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3576915.3623200 · Cited by 7
SoK: Security and Privacy of Blockchain InteroperabilityPreprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2023) · doi:10.36227/techrxiv.24595764 · Cited by 8
SoK: Security and Privacy of Blockchain Interoperability [Extended Version]Preprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2024) · doi:10.36227/techrxiv.24595764.v4 · Cited by 6
CHERIoT RTOS: An OS for Fine-Grained Memory-Safe Compartments on Low-Cost Embedded Devices
Amar, S., Chen, T., Chisnall, D., Filardo, N. W., Laurie, B., Lefeuvre, H., Liu, K., Moore, S. W., Norton-Wright, R., Seltzer, M., et al. (2025) · ACM SIGOPS Symposium on Operating Systems Principles (SOSP) · doi:10.1145/3731569.3764844 · Cited by 5
Closing the Chain: How to reduce your risk of being SolarWinds, Log4j, or XZ Utils
Hamer, S., Bowen, J., Haque, M. N., Hines, R., Madden, C., & Williams, L. A. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773194 · Cited by 6
$ZTD_{\text{JAVA}}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies
Amusuo, P. C., Robinson, K. A., Singla, T., Peng, H., Machiry, A., Torres-Arias, S., Simon, L., & Davis, J. C. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00148 · Cited by 7
An Analysis of Malicious Packages in Open-Source Software in the Wild
Zhou, X., Zhang, Y., Niu, W., Liu, J., Wang, H., & Li, Q. (2025) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn64029.2025.00045 · Cited by 5
Anjum, N., Sakib, N., Rodriguez-Cardenas, J., Brookins, C., Norouzinia, A., Shavers, A., Dominguez, M., Nassif, M., & Shahriar, H. (2023) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac57700.2023.00281 · Cited by 5
SoK: A Taxonomic Analysis of DeFi Rug Pulls: Types, Dataset, and Tool Assessment
Sun, D., Ma, W., Nie, L., & Liu, Y. (2025) · Proceedings of the ACM on software engineering. · doi:10.1145/3728900 · Cited by 17
Are Your Dependencies Code Reviewed?: Measuring Code Review Coverage in Dependency Updates
Imtiaz, N., & Williams, L. A. (2023) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2023.3319509 · Cited by 4
Extending The Update Framework (TUF) for Industrial Control System Applications
Romansky, B., Mazzuchi, T. A., & Sarkani, S. (2024) · IEEE SoutheastCon · doi:10.1109/southeastcon52093.2024.10500028 · Cited by 4
Yang, L., Zhang, H., Xu, J., Lyu, J., Zhou, X., Shao, D., Gao, S., & Bacchelli, A. (2024) · Empirical Software Engineering · doi:10.1007/s10664-024-10526-9 · Cited by 4
Exploring the Landscape of Programming Language Identification With Machine Learning Approaches
Verma, A., Saha, R., Kumar, G., Brighente, A., Conti, M., & Kim, T.-H. (2025) · IEEE Access · doi:10.1109/access.2025.3538108 · Cited by 4
Hamer, S., Imtiaz, N., Tamanna, M., Shabrina, P., & Williams, L. A. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3551664 · Cited by 4
Artemis: Defanging Software Supply Chain Attacks in Multi-repository Update Systems
Moore, M., Kuppusamy, T. K., & Cappos, J. (2023) · Annual Computer Security Applications Conference · doi:10.1145/3627106.3627129 · Cited by 4
Detecting Python Malware in the Software Supply Chain with Program Analysis
Shariffdeen, R., Hassanshahi, B., Мирчев, М., Husseini, A. E., & Roychoudhury, A. (2025) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip66354.2025.00024 · Cited by 4
SoK: Security and Privacy of Blockchain InteroperabilityPreprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2023) · doi:10.36227/techrxiv.24595764.v1 · Cited by 5
Exposing the Hidden Layer: Software Repositories in the Service of Seo Manipulation
Wu, M., Hong, G., Mai, W., Wu, X., Zhang, L., Pu, Y., Chai, H., Ying, L., Duan, H., & Yang, M. (2025) · 2025 IEEE/ACM 47th International Conference on Software Engineering (ICSE) · doi:10.1109/icse55347.2025.00147 · Cited by 3
Establishing Provenance Before Coding: Traditional and Next-Generation Software Signing
Schorlemmer, T. R., Burmane, E. H., Kalu, K. G., Torres-Arias, S., & Davis, J. C. (2025) · IEEE Security & Privacy · doi:10.1109/msec.2025.3537616 · Cited by 3
Akhoundali, J., Hamidi, H., Rietveld, K. F. D., & Gadyatskaya, O. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3736220 · Cited by 3
Wolf in Sheep’s Clothing: Shearing the Camouflage of Malicious Java Components in Maven
Zeng, Y., Huang, C., Han, J., Zhao, J., Wang, N., Liang, G., & Jiang, S. (2025) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2025.3599732 · Cited by 3
Jin, Z., Lu, X., Yang, B., Cheng, Y., Yan, C., Ji, X., & Xu, W. (2024) · International World Wide Web Conference (WWW) · doi:10.1145/3589334.3645612 · Cited by 3
Integrating Artificial Open Generative Artificial Intelligence into Software Supply Chain Security
Alevizos, V., Papakostas, G. A., Simasiku, A., Malliarou, D., Messinis, A., Edralin, S., Xu, C., & Yue, Z. (2024) · International Conference on Data Analytics for Business and Industry (ICDABI) · doi:10.1109/icdabi63787.2024.10800301 · Cited by 4
Jiang, W., Çakar, B., Lysenko, M., & Davis, J. C. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773229 · Cited by 13
Assessing the Real Impact of Open-Source Components in Software Systems
Molin, A., Riviş, A. M., & Marinescu, R. (2023) · IEEE Access · doi:10.1109/access.2023.3322362 · Cited by 3
A Viewpoint on Software Supply Chain Security: Are We Getting Lost in Translation?
Melara, M. S., & Torres-Arias, S. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3316568 · Cited by 3
A Knowledge-driven Framework for Software Supply Chain Security Analysis
Sun, Z., Quan, Z., Yu, S., Zhang, L., & Mao, D. (2024) · International Conference on Control Engineering and Artificial Intelligence (CCEAI) · doi:10.1145/3640824.3640866 · Cited by 3
SoK: Intelligent Detection for Polycystic Ovary Syndrome(PCOS)Preprint
Li, M., He, Z. S., Nie, L., Shi, L., Lin, M., Li, M., Cheng, Y., Liu, H., & Xue, L. (2024) · medRxiv · doi:10.1101/2024.12.25.24319623 · Cited by 3
A Machine Learning-Based Approach For Detecting Malicious PyPI Packages
Sammaneh, H., Costa, D. E., Shihab, E., & Abdellatif, A. (2025) · ACM Symposium on Applied Computing · doi:10.1145/3672608.3707756 · Cited by 2
PuRe Defender: A Game-Theoretic Pull Request Assignment with Deep RL
Koushyar, J. M., Guirguis, M., & Atia, G. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-08064-6_10 · Cited by 2
Towards Socio-Technical Topology-Aware Adaptive Threat Detection in Software Supply Chains
Welsh, T., Finnsson, K., Stefáansson, B., & Neukirchen, H. (2025) · International Conference on Social Networks Analysis, Management and Security (SNAMS) · doi:10.1109/snams67467.2025.11391209 · Cited by 2
Syed, T. A., Belgaum, M. R., Jan, S., Khan, A. A., & Alqahtany, S. S. (2025) · International Conference on Computer and Applications (ICCA) · doi:10.1109/icca66035.2025.11430751 · Cited by 4
Major milestone in open source security
issues, C., & Markov, A. (2023) · Voprosy kiberbezopasnosti · doi:10.21681/2311-3456-2023-1-2-12 · Cited by 2
Software Bill of Materials in Java
Balliu, M., Baudry, B., Bobadilla, S., Ekstedt, M., Monperrus, M., Ron, J., Sharma, A., Skoglund, G., Soto-Valero, C., & Wittlinger, M. (2023) · ACM Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses (SCORED) · doi:10.1145/3605770.3625207 · Cited by 2
Heinl, M. P., & Embacher, V. (2024) · ACM Workshop on CPS&IoT Security and Privacy (CPSIoTSec) · doi:10.1145/3690134.3694816 · Cited by 2
An Analysis of Malicious Behaviors of Open-Source Packages Using Dynamic Analysis
Nguyen, T.-C., Vu, D., & Debnath, N. C. (2024) · Communications in computer and information science · doi:10.1007/978-3-031-76273-4_8 · Cited by 2
Study of Attacks on the HHL Quantum Algorithm
Tan, Y., Kukina, H., & Szefer, J. M. (2024) · IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA) · doi:10.1109/tps-isa62245.2024.00064 · Cited by 2
Zhang, G., Yao, T., Qin, J., Li, Y., Ma, Q., & Sun, D. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.103973 · Cited by 5
Zhang, S., Ma, J., Bai, H., Ren, Y., Jia, N., & Hu, X. (2024) · IEEE International Conference on Network Protocols (ICNP) · doi:10.1109/icnp61940.2024.10858537 · Cited by 2
Iqbal, T., Wu, G., Iqbal, Z., Mahmood, M. B., Shafique, A., & Guo, W. (2025) · Journal of Information Security and Applications · doi:10.1016/j.jisa.2025.104032 · Cited by 2
MatriXSSed: A New Taxonomy for XSS in the Modern Web
Somé, D. F. (2025) · International World Wide Web Conference (WWW) · doi:10.1145/3696410.3714774 · Cited by 2
Dirty-Waters: Detecting Software Supply Chain Smells
Liu, R., Bobadilla, S., Baudry, B., & Monperrus, M. (2025) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3696630.3728578 · Cited by 2
What Can Self-Admitted Technical Debt Tell Us About Security? A Mixed-Methods StudyPreprint
Ferreyra, N. E. D., Shahin, M., Zahedi, M., Quadri, S., & Scandariato, R. (2024) · arXiv (Cornell University) · doi:10.48550/arxiv.2401.12768 · Cited by 2
SoK: Security and Privacy of Blockchain Interoperability [Extended Version]Preprint
Augusto, A., Belchior, R., Correia, M. P., Vasconcelos, A., Zhang, L., & T, T. H. M. I. (2024) · doi:10.36227/techrxiv.24595764.v2 · Cited by 4
Issues in the Implementation of Secure Software Development Processes
Markov, A. S., Varenitca, V. V., & Arustamyan, S. S. (2023) · Seminar on Information Systems Theory and Practice (ISTP) · doi:10.1109/istp60767.2023.10427367 · Cited by 1
More Haste, Less Speed: Cache Related Security Threats in Continuous Integration Services
Gu, Y., Ying, L., Chai, H., Pu, Y., Duan, H., & Gao, X. (2024) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp54263.2024.00138 · Cited by 1
AdapSan: Adaptive Input Sanitization in Medical Systems with eBPF
Chang, S., Li, A., Jaff, E., Chang, Y., Wang, J., Zhang, N., & Hsiao, H. (2024) · doi:10.1145/3689935.3690397 · Cited by 1
Test Suites Guided Vulnerability Validation for Node.js Applications
Luo, C., Li, P., Meng, W., & Zhang, C. (2024) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3658644.3690332 · Cited by 1
AAF-SCM: An Authenticated Framework for Supply Chain Management
Roy, P., Kumar, R., & Morshed, M. N. (2024) · International Conference on Intelligent Systems and Advanced Applications (ICISAA) · doi:10.1109/icisaa62385.2024.10829139 · Cited by 1
Analysis of Supply Chain Attacks in Open-Source Software and Mitigation Strategies
Merigala, J., Kumar, V., Gujjarlapudi, J., Gupta, M., & Kumar, A. (2024) · International Conference on Communication, Computing and Industry 4.0 (C2I4) · doi:10.1109/c2i663243.2024.10895136 · Cited by 1
Who's Pushing the Code? An Exploration of GitHub Impersonation
Zhang, Y., Liang, A., Wang, X., Wiśniewski, P., Zhang, F., Leach, K., & Huang, Y. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse55347.2025.00065 · Cited by 1
POSTER:TYPOSQUATTING ATTACKS ON THE RUST ECOSYSTEM
Vu, M.-K., Nguyen, T.-C., & Vu, D. (2025) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3708821.3735340 · Cited by 1
Metadata
- Authors
- Ladisa, P., Plate, H., Martinez, M., & Barais, O.
- Affiliations
- Systems, Applications & Products in Data Processing (Switzerland) (CH)
- Université Polytechnique Hauts-de-France
- Institut national de recherche en sciences et technologies du numérique (FR)
- Venue
- 2023 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2023-05
- Pages
- 1509-1526
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W4385208592
- Cited by
- 208
- References
- 94
- Citations by year
- 2026: 65 · 2025: 63 · 2024: 46 · 2023: 32
- FWCI
- 52.94
- Type
- conference paper
- Language
- en
- Open access
- green
- inria.hal.science
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- HAL (submittedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- attack taxonomy, supply chain attacks, malicious code injection, attack trees, software supply chain security, security measures, developer survey, attack vectors
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
