The DOI matches its Crossref record; 93 of the 94 references it cites were found in a registry or an index.
SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Open accessAbstract
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today’s open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims.This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“PQC transition affects all three due to increased key sizes, larger signature sizes, and hybrid mode requirements during the transition period [17,18].”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“IETF drafts for hybrid key exchange [17,18], PQC certificate profiles, and composite signature formats are still in progress.”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Systematic Literature Reviews in Software Engineering—A Systematic Literature Review
Kitchenham, B., Pearl Brereton, O., Budgen, D., Turner, M., Bailey, J., & Linkman, S. (2009) · Information and Software Technology · doi:10.1016/j.infsof.2008.09.009 · Cited by 4,537
Experimentation in Software Engineering
Wohlin, C., Runeson, P., Höst, M., Ohlsson, M. C., Regnell, B., & Wesslén, A. (2012) · doi:10.1007/978-3-642-29044-2 · Cited by 4,460
Goodman, L. A. (1961) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177705148 · Cited by 3,606
2017 USENIX Annual Technical Conference (USENIX ATC'17)
Quoc, D. L., Beck, M. S., Bhatotia, P., Chen, R., Fetzer, C. W., & Strufe, T. (2017) · Cited by 3,091
Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J. G., Payer, M., Weaver, N., Adrian, D., Paxson, V., Bailey, M., et al. (2014) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2663716.2663755 · Cited by 692
Thompson, K. (1984) · Communications of the ACM · doi:10.1145/358198.358210 · Cited by 670
Malware Obfuscation Techniques: A Brief Survey
You, I., & Yim, K. (2010) · 2010 International Conference on Broadband, Wireless Computing, Communication and Applications · doi:10.1109/bwcca.2010.85 · Cited by 607
Mauw, S., & Oostdijk, M. (2006) · Lecture notes in computer science · doi:10.1007/11734727_17 · Cited by 504
(2008) · doi:10.1016/b978-0-12-373558-4.x0001-5 · Cited by 287
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-52683-2_2 · Cited by 259
Self-citation
Research works printed but not linked: 19
- Clancy, 2021, Deliver uncompromised: Securing critical software supply chains, MITRE Technical Papers, 24
- Wu, On the feasibility of stealthily introducing vulnerabilities in open-source software via hypocrite commits
- Haddad, 2011, Understanding the open source development model, Linux Journal
- Cox, 2019, Our software dependency problem
- Schneier, 1999, Attack trees, Dr. Dobb’s journal, 24, 21
- Spencer, 2009, Card sorting: Designing usable categories
- Du, Towards an analysis of software supply chain risk management, 1
- Tschacher, 2016, Typosquatting in programming language package managers
- An emergency re-review of kernel commits authored by members of the university of minnesota, due to the hypocrite commits research paper
- Kuppusamy, Mercury: Bandwidth-effective prevention of rollback attacks against community repositories, 673
- McClure, 2010, Protecting your critical assets-lessons learned from operation aurora, Tech. Rep.
- Goerigk, On trojan horses in compiler implementations
- Kuppusamy, Diplomat: Using delegations to protect community repositories, 567
- Alhamed, Security by decentralized certification of automatic-updates for open source software controlled by volunteers
- Almubayed, 2019, Practical approach to automate the discovery and eradication of opensource software vulnerabilities at scale, Blackhat USA
- 10.1007/978-3-030-65745-1_7 · DOI
- Lamowski, Sand-crust: Automatic sandboxing of unsafe components in rust, 51
- 10.1002/smr.1893 · DOI
- 10.1109/CSAC.2005.17 · DOI
Cited by
Sorted by citations
Items 201–208 of 208
Mejías, A. I. V., Charlo, R. E. R., & Alcaide, J. I. (2026) · Metrics · doi:10.3390/metrics3040023
Digital Financial Inclusion and Its Impact on Economic Growth
Shivaji, D. A. A. F. G. B., & Bamane, K. D. (2026) · International Journal of Emerging Technologies and Innovative Research · doi:10.48175/ijetir-2025
Raszka, L., & Grycz, O. (2026) · SSRN Electronic Journal · doi:10.2139/ssrn.7592667
OSSGuard: A Game-Theoretic Framework for Trust and Security in Open-Source Ecosystems
Koushyar, J. M., Guirguis, M., & Atia, G. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-40367-4_29
Wang, Y. D., & You, Z. (2026) · International Conference on Computer Application and Computer Graphics · doi:10.1145/3844212.3844261
Visual Graph Representations for Supply Chain Risk Detection: A Novel Study on npm Packages
Lima, P. V. C., Quincozes, S. E., & do Nascimento, M. Z. (2026) · Simpósio Brasileiro de Cibersegurança (SBSeg) · doi:10.5753/sbseg.2026.28944
Wang, J., Mao, D., Han, Y., Quan, Z., & Wang, B. (2026) · Electronics · doi:10.3390/electronics15215021
Kurogome, Y. (2026) · Lecture notes in computer science · doi:10.1007/978-3-032-42939-1_2
Metadata
- Authors
- Ladisa, P., Plate, H., Martinez, M., & Barais, O.
- Affiliations
- Systems, Applications & Products in Data Processing (Switzerland) (CH)
- Université Polytechnique Hauts-de-France
- Institut national de recherche en sciences et technologies du numérique (FR)
- Venue
- 2023 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2023-05
- Pages
- 1509-1526
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W4385208592
- Cited by
- 208
- References
- 94
- Citations by year
- 2026: 65 · 2025: 63 · 2024: 46 · 2023: 32
- FWCI
- 52.94
- Type
- conference paper
- Language
- en
- Open access
- green
- inria.hal.science
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- HAL (submittedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- attack taxonomy, supply chain attacks, malicious code injection, attack trees, software supply chain security, security measures, developer survey, attack vectors
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
