The DOI matches its Crossref record; 93 of the 94 references it cites were found in a registry or an index.
SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
Open accessAbstract
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today’s open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims.This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards.User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“PQC transition affects all three due to increased key sizes, larger signature sizes, and hybrid mode requirements during the transition period [17,18].”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
Experimental — accuracy not yet measuredThe check wasn’t confident either way, so it gives no verdict — never disputed.
In the citing paper
“IETF drafts for hybrid key exchange [17,18], PQC certificate profiles, and composite signature formats are still in progress.”
From AI Supply Chain Security: MBOM-PQC Provenance, PQC Attestation, and a Maturity Model for Quantum-Resistant Assurance (2026) · cites this paper as [17]
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Systematic Literature Reviews in Software Engineering—A Systematic Literature Review
Kitchenham, B., Pearl Brereton, O., Budgen, D., Turner, M., Bailey, J., & Linkman, S. (2009) · Information and Software Technology · doi:10.1016/j.infsof.2008.09.009 · Cited by 4,537
Experimentation in Software Engineering
Wohlin, C., Runeson, P., Höst, M., Ohlsson, M. C., Regnell, B., & Wesslén, A. (2012) · doi:10.1007/978-3-642-29044-2 · Cited by 4,460
Goodman, L. A. (1961) · The Annals of Mathematical Statistics · doi:10.1214/aoms/1177705148 · Cited by 3,606
2017 USENIX Annual Technical Conference (USENIX ATC'17)
Quoc, D. L., Beck, M. S., Bhatotia, P., Chen, R., Fetzer, C. W., & Strufe, T. (2017) · Cited by 3,091
Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J. G., Payer, M., Weaver, N., Adrian, D., Paxson, V., Bailey, M., et al. (2014) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2663716.2663755 · Cited by 692
Thompson, K. (1984) · Communications of the ACM · doi:10.1145/358198.358210 · Cited by 670
Malware Obfuscation Techniques: A Brief Survey
You, I., & Yim, K. (2010) · 2010 International Conference on Broadband, Wireless Computing, Communication and Applications · doi:10.1109/bwcca.2010.85 · Cited by 607
Mauw, S., & Oostdijk, M. (2006) · Lecture notes in computer science · doi:10.1007/11734727_17 · Cited by 504
(2008) · doi:10.1016/b978-0-12-373558-4.x0001-5 · Cited by 287
Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks
Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-52683-2_2 · Cited by 259
Self-citationOn the impact of security vulnerabilities in the npm package dependency network
Decan, A., Mens, T., & Constantinou, E. (2018) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3196398.3196401 · Cited by 236
Principles of Sociological Inquiry – Qualitative and Quantitative Methods
Blackstone, A. (2014) · Cited by 154
Intelligence in the internet age: The emergence and evolution of Open Source Intelligence (OSINT)
Glassman, M., & Kang, M. (2011) · Computers in Human Behavior · doi:10.1016/j.chb.2011.11.014 · Cited by 153
Small World with High Risks: A Study of Security Threats in the npm EcosystemPreprint
Zimmermann, M. N., Staicu, C.-A., Tenny, C., & Pradel, M. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.09217 · Cited by 147
Threat analysis of software systems: A systematic literature review
Tuma, K., Çalıklı, G., & Scandariato, R. (2018) · Journal of Systems and Software · doi:10.1016/j.jss.2018.06.073 · Cited by 126
Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages
Duan, R., Alrawi, O., Kasturi, R. P., Elder, R., Saltaformaggio, B., & Lee, W. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.23055 · Cited by 121
Survivable key compromise in software update systems
Samuel, J., Mathewson, N., Cappos, J., & Dingledine, R. (2010) · Proceedings of the 17th ACM conference on Computer and communications security · doi:10.1145/1866307.1866315 · Cited by 120
Vulnerable open source dependencies
Николаевич, П. И., Plate, H., Ponta, S. E., Sabetta, A., & Massacci, F. (2018) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1145/3239235.3268920 · Cited by 110
Self-citationSecurity in the Software Development Lifecycle
Assal, H., & Chiasson, S. (2018) · Cited by 107
What are weak links in the npm supply chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513044 · Cited by 104
A comprehensive study of bloated dependencies in the Maven ecosystem
Soto-Valero, C., Harrand, N., Monperrus, M., & Baudry, B. (2021) · Empirical Software Engineering · doi:10.1007/s10664-020-09914-8 · Cited by 102
Impact assessment for vulnerabilities in open-source software libraries
Plate, H., Ponta, S. E., & Sabetta, A. (2015) · IEEE International Conference on Software Maintenance and Evolution (ICSME) · doi:10.1109/icsm.2015.7332492 · Cited by 100
Self-citationReproducible Builds: Increasing the Integrity of Software Supply Chains
Lamb, C., & Zacchiroli, S. (2021) · IEEE Software · doi:10.1109/ms.2021.3073045 · Cited by 90
SYNODE: Understanding and Automatically Preventing Injection Attacks on NODE.JS
Staicu, C.-A., Pradel, M., & Livshits, B. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23071 · Cited by 87
Secure software updates: disappointments and new challenges
Bellissimo, A., Burgess, J., & Fu, K. E. (2006) · Cited by 86
Practical automated detection of malicious npm packages
Sejfia, A., & Schäfer, M. (2022) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3510003.3510104 · Cited by 86
Perspectives on the SolarWinds Incident
Peisert, S., Schneier, B., Okhravi, H., Massacci, F., Benzel, T., Landwehr, C. E., Mannan, M., Mirković, J., Prakash, A., & Michael, J. B. (2021) · IEEE Security & Privacy · doi:10.1109/msec.2021.3051235 · Cited by 84
A comparative study of vulnerability reporting by software composition analysis tools
Imtiaz, N., Thorn, S., & Williams, L. A. (2021) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1145/3475716.3475769 · Cited by 82
Executive Order 14028: Improving the Nation's Cybersecurity
Biden, J. R. (2021) · United States. Office of the Federal Register · Cited by 78
A Practical Approach to the Automatic Classification of Security-Relevant Commits
Sabetta, A., & Michele Bezzi, A. (2018) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme.2018.00058 · Cited by 77
Cappos, J., Samuel, J., Baker, S., & Hartman, J. H. (2008) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/1455770.1455841 · Cited by 76
Thirty years later: lessons from the Multics security evaluation
Karger, P. A., & Schell, R. R. (2003) · Annual Computer Security Applications Conference · doi:10.1109/csac.2002.1176285 · Cited by 70
Typosquatting and Combosquatting Attacks on the Python Ecosystem
Vu, D., Николаевич, П. И., Massacci, F., Plate, H., & Sabetta, A. (2020) · IEEE European Symposium on Security and Privacy Workshops (EuroS&PW) · doi:10.1109/eurospw51379.2020.00074 · Cited by 66
Self-citationTowards Using Source Code Repositories to Identify Software Supply Chain Attacks
Vu, D., Николаевич, П. И., Massacci, F., Plate, H., & Sabetta, A. (2020) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3372297.3420015 · Cited by 62
Self-citationFass, A., Michael Backes, A., & Stock, B. (2019) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3319535.3345656 · Cited by 61
Detecting Suspicious Package Updates
Garrett, K. A., Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2019) · IEEE/ACM International Conference on Software Engineering: New Ideas and Emerging Results (ICSE-NIER) · doi:10.1109/icse-nier.2019.00012 · Cited by 59
Anomalicious: Automated Detection of Anomalous and Potentially Malicious Commits on GitHub
Gonzalez, D., Zimmermann, T., Godefroid, P., & Schaefer, M. (2021) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip52600.2021.00035 · Cited by 59
Towards detection of software supply chain attacks by forensic artifacts
Ohm, M., Sykosch, A., & Meier, M. (2020) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3407023.3409183 · Cited by 58
LastPyMile: identifying the discrepancy between sources and packages
Vu, D., Massacci, F., Николаевич, П. И., Plate, H., & Sabetta, A. (2021) · ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE) · doi:10.1145/3468264.3468592 · Cited by 56
Self-citationBreakApp: Automated, Flexible Application Compartmentalization
Vasilakis, N., Karel, B., Roessler, N., Dautenhahn, N., DeHon, A. M., & Smith, J. M. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23131 · Cited by 54
Identifying unmaintained projects in github
Coelho, J., Valente, M. T., Silva, L. L., & Shihab, E. (2018) · Proceedings of the ... ACM-IEEE International Symposium on Empirical Software Engineering and Measurement/International Symposium on Empirical Software Engineering and Measurement · doi:10.1145/3239235.3240501 · Cited by 54
Containing Malicious Package Updates in npm with a Lightweight Permission System
Ferreira, G., Jia, L., Sunshine, J., & Kästner, C. (2021) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse43902.2021.00121 · Cited by 51
On the impact of using trivial packages: an empirical case study on npm and PyPI
Abdalkareem, R., Oda, V., Mujahid, S., & Shihab, E. (2020) · Empirical Software Engineering · doi:10.1007/s10664-019-09792-9 · Cited by 49
Defending Against Package Typosquatting
Taylor, M., Vaidya, R. K., Davidson, D., Carli, L. D., & Rastogi, V. (2020) · Lecture notes in computer science · doi:10.1007/978-3-030-65745-1_7 · Cited by 49
A Socio-technical Framework for Threat Modeling a Software Supply Chain
Sabbagh, B. A., & Kowalski, S. J. (2015) · IEEE Security & Privacy · doi:10.1109/msp.2015.72 · Cited by 45
Pewny, J., & Holz, T. (2016) · doi:10.1145/2991079.2991103 · Cited by 44
Assessing the security of Node.js platform
Ojamaa, A., & Düüna, K. (2012) · International Conference for Internet Technology and Secured Transactions · Cited by 42
Countering Trusting Trust through Diverse Double-Compiling
Wheeler, D. (2006) · Annual Computer Security Applications Conference · doi:10.1109/csac.2005.17 · Cited by 39
Identification of Dependency-based Attacks on Node.js
Pfretzschner, B., & Othmane, L. B. (2017) · International Conference on Availability, Reliability and Security (ARES) · doi:10.1145/3098954.3120928 · Cited by 39
Identifying unusual commits on GitHub
Goyal, R., Ferreira, G., Kästner, C., & Herbsleb, J. D. (2017) · Journal of Software Evolution and Process · doi:10.1002/smr.1893 · Cited by 39
Empirical Study of Restarted and Flaky Builds on Travis CI
Durieux, T., Goues, C. L., Hilton, M. L., & Abreu, R. (2020) · International Conference on Mining Software Repositories (MSR) · doi:10.1145/3379597.3387460 · Cited by 37
Securing a Deployment Pipeline
Bass, L., Holz, R., Rimba, P., Tran, A. B., & Zhu, L. (2015) · doi:10.1109/releng.2015.11 · Cited by 37
in-toto: Providing farm-to-table guarantees for bits and bytes
Torres-Arias, S., Afzali, H., Kuppusamy, T. K., Curtmola, R., & Cappos, J. (2019) · USENIX Security Symposium · Cited by 36
Poisoning the software supply chain
Levy, E. (2003) · IEEE Security & Privacy · doi:10.1109/msecp.2003.1203227 · Cited by 34
A Systemic Approach for Assessing Software Supply-Chain Risk
Alberts, C., Dorofee, A., Creel, R., Ellison, R. J., & Woody, C. (2011) · Hawaii International Conference on System Sciences (HICSS) · doi:10.1109/hicss.2011.36 · Cited by 33
Supply-Chain Risk Management: Incorporating Security into Software Development
Ellison, R. J., & Woody, C. (2010) · Proceedings of the ... Annual Hawaii International Conference on System Sciences/Proceedings of the Annual Hawaii International Conference on System Sciences · doi:10.1109/hicss.2010.355 · Cited by 32
Investigating The Reproducibility of NPM Packages
Goswami, P., Gupta, S., Li, Z., Meng, N., & Yao, D. (2020) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme46990.2020.00071 · Cited by 29
Identifying Challenges for OSS Vulnerability Scanners - A Study & Test Suite
Dann, A., Plate, H., Hermann, B., Ponta, S. E., & Bodden, E. (2021) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2021.3101739 · Cited by 28
Self-citationNeil, L., Mittal, S., & Joshi, A. (2018) · IEEE International Conference on Intelligence and Security Informatics (ISI) · doi:10.1109/isi.2018.8587375 · Cited by 27
Vulnerabilities in Continuous Delivery Pipelines? A Case Study
Paule, C., Düllmann, T. F., & van Hoorn, A. (2019) · IEEE International Conference on Software Architecture Companion (ICSA-C) · doi:10.1109/icsa-c.2019.00026 · Cited by 27
Challenges and implications of verifiable builds for security-critical open-source software
de Carnavalet, X. D. C., & Mannan, M. (2014) · Annual Computer Security Applications Conference · doi:10.1145/2664243.2664288 · Cited by 25
Information Security and Open Source Dual Use Security Software: Trust Paradox
Silić, M., & Bäck, A. (2013) · IFIP advances in information and communication technology · doi:10.1007/978-3-642-38928-3_14 · Cited by 24
Security of public continuous integration services
Gruhn, V., Hannebauer, C., & John, C. (2013) · International Symposium on Open Collaboration · doi:10.1145/2491055.2491070 · Cited by 24
Supply-Chain Vulnerability Elimination via Active Learning and Regeneration
Vasilakis, N., Benetopoulos, A., Handa, S., Schoen, A., Shen, J., & Rinard, M. (2021) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3460120.3484736 · Cited by 24
A Global, Empirical Analysis of the Shellshock Vulnerability in Web Applications
Delamore, B., & Ko, R. K. L. (2015) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications / BigDataSE / ISPA (Trustcom/BigDataSE/ISPA) · doi:10.1109/trustcom.2015.493 · Cited by 20
Modeling Supply Chain Attacks in IEC 61850 Substations
Duman, O., Ghafouri, M., Kassouf, M., Atallah, R. F., Wang, L., & Debbabi, M. (2019) · IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm) · doi:10.1109/smartgridcomm.2019.8909818 · Cited by 20
Security Issues in Language-based Sofware Ecosystems.Preprint
Vaidya, R. K., Carli, L. D., Davidson, D., & Rastogi, V. (2019) · arXiv (Cornell University) · Cited by 19
A Survey on Common Threats in npm and PyPi Registries
Kaplan, B., & Qian, J. (2021) · Communications in computer and information science · doi:10.1007/978-3-030-87839-9_6 · Cited by 18
Assessing Attack Surface with Component-Based Package Dependency
Zhang, S., Zhang, X., Ou, X., Chen, L., Edwards, N., & Jin, J. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-25645-0_29 · Cited by 17
Current Taxonomy of Information Security Threats in Software Development Life Cycle
Barabanov, A., Markov, A. S., Иванович, Г. М., & Tsirlov, V. L. (2018) · IEEE International Conference on Application of Information and Communication Technologies (AICT) · doi:10.1109/icaict.2018.8747065 · Cited by 17
Torres-Arias, S., Ammula, A. K., Curtmola, R., & Cappos, J. (2016) · USENIX Security Symposium · Cited by 16
Trojan Source: Invisible VulnerabilitiesPreprint
Boucher, N., & Anderson, R. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2111.00169 · Cited by 14
Wright, C. (2008) · CERN Document Server (European Organization for Nuclear Research) · Cited by 13
Breaking Trust – Shades of Crisis Across an Insecure Software Supply Chain
Herr, T. (2021) · Cited by 13
Towards Measuring Supply Chain Attacks on Package Managers for Interpreted LanguagesPreprint
Duan, R., Alrawi, O., Kasturi, R. P., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2002.01139 · Cited by 13
Assessing software supply chain risk using public data
Benthall, S. (2017) · doi:10.1109/stc.2017.8234461 · Cited by 11
py2src: Towards the Automatic (and Reliable) Identification of Sources for PyPI Package
Vu, D. (2021) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase51524.2021.9678526 · Cited by 10
SpellBound: Defending Against Package TyposquattingPreprint
Taylor, M., Vaidya, R. K., Davidson, D., et al. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2003.03471 · Cited by 10
Towards An Analysis of Software Supply Chain Risk Management
Du, S., Lu, T., Zhao, L., Xu, B., Guo, X., & Yang, H. (2013) · Lecture notes in computer science · Cited by 9
Yurtsevenler, F. E. (2026) · Zenodo (CERN European Organization for Nuclear Research) · doi:10.5281/zenodo.21908303 · Cited by 9
Trust and tamper-proof software delivery
Naedele, M., & Koch, T. E. (2006) · International Workshop on Software Engineering for Secure Systems (SESS) · doi:10.1145/1137627.1137636 · Cited by 8
Marjanović, J., Dalčeković, N., & Sladić, G. (2021) · doi:10.1145/3459960.3459973 · Cited by 8
ShIFt - Software Identity Framework for Global Software Delivery
Singi, K., Kaulgud, V., Bose, R. P. J. C., & Podder, S. (2019) · IEEE International Conference on Global Software Engineering (ICGSE) · doi:10.1109/icgse.2019.00032 · Cited by 7
Supply chain risk management - Understanding vulnerabilities in code you buy, build, or integrate
Croll, P. R. (2011) · 2020 IEEE International Systems Conference (SysCon) · doi:10.1109/syscon.2011.5929123 · Cited by 6
Supporting the Detection of Software Supply Chain Attacks through Unsupervised Signature GenerationPreprint
Ohm, M., Kempf, L., Boes, F., & Meier, M. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2011.02235 · Cited by 6
Dependencies: No Software is an Island
Tellnes, J. (2013) · Cited by 6
Assuring software and hardware security and integrity throughout the supply chain
Axelrod, C. W. (2011) · IEEE International Conference on Technologies for Homeland Security · doi:10.1109/ths.2011.6107848 · Cited by 5
Software distribution as a malware infection vector
Gröbert, F., Sadeghi, A., & Winandy, M. (2009) · International Conference for Internet Technology and Secured Transactions · doi:10.1109/icitst.2009.5402538 · Cited by 5
Windows Malware Binaries in C/C++ GitHub Repositories: Prevalence and Lessons Learned
Cholter, W. L., Elder, M., & Stalick, A. Q. (2021) · International Conference on Information Systems Security and Privacy (ICISSP) · doi:10.5220/0010237904750484 · Cited by 4
I Know What You Imported Last Summer: A study of security threats in thePython ecosystemPreprint
Bagmar, A., Wedgwood, J., Levin, D., et al. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2102.06301 · Cited by 4
2020 State of the Octoverse: Securing the World's SoftwarePreprint
Forsgren, N., Alberts, B., Backhouse, K., Baker, G., Ceccarelli, G., Jedamski, D., Kelly, S., & Sullivan, C. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2110.10246 · Cited by 4
Giovanini, L., Oliveira, D. S., Sanchez, H. A., & Shands, D. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2106.16067 · Cited by 3
(2023) · Oxford University Press eBooks · doi:10.1093/oed/7202462049 · Cited by 1
Research works printed but not linked: 19
- Clancy, 2021, Deliver uncompromised: Securing critical software supply chains, MITRE Technical Papers, 24
- Wu, On the feasibility of stealthily introducing vulnerabilities in open-source software via hypocrite commits
- Haddad, 2011, Understanding the open source development model, Linux Journal
- Cox, 2019, Our software dependency problem
- Schneier, 1999, Attack trees, Dr. Dobb’s journal, 24, 21
- Spencer, 2009, Card sorting: Designing usable categories
- Du, Towards an analysis of software supply chain risk management, 1
- Tschacher, 2016, Typosquatting in programming language package managers
- An emergency re-review of kernel commits authored by members of the university of minnesota, due to the hypocrite commits research paper
- Kuppusamy, Mercury: Bandwidth-effective prevention of rollback attacks against community repositories, 673
- McClure, 2010, Protecting your critical assets-lessons learned from operation aurora, Tech. Rep.
- Goerigk, On trojan horses in compiler implementations
- Kuppusamy, Diplomat: Using delegations to protect community repositories, 567
- Alhamed, Security by decentralized certification of automatic-updates for open source software controlled by volunteers
- Almubayed, 2019, Practical approach to automate the discovery and eradication of opensource software vulnerabilities at scale, Blackhat USA
- 10.1007/978-3-030-65745-1_7 · DOI
- Lamowski, Sand-crust: Automatic sandboxing of unsafe components in rust, 51
- 10.1002/smr.1893 · DOI
- 10.1109/CSAC.2005.17 · DOI
Cited by
Sorted by citations
Research Directions in Software Supply Chain Security
Williams, L. A., Benedetti, G., Hamer, S., Paramitha, R., Rahman, I., Tamanna, M., Tystahl, G., Zahan, N., Morrison, P. J., Acar, Y., et al. (2025) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3714464 · Cited by 111
An Empirical Study of Malicious Code In PyPI Ecosystem
Guo, W., Xu, Z., Liu, C., Huang, C., Fang, Y., & Liu, Y. (2023) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase56229.2023.00135 · Cited by 53
Cob-Parro, A. C., Lalangui, Y., & Lazcano, R. (2024) · Agronomy · doi:10.3390/agronomy14020259 · Cited by 41
Challenges of Producing Software Bill of Materials for Java
Balliu, M., Baudry, B., Bobadilla, S., Ekstedt, M., Monperrus, M., Ron, J., Sharma, A., Skoglund, G., Soto-Valero, C., & Wittlinger, M. (2023) · IEEE Security & Privacy · doi:10.1109/msec.2023.3302956 · Cited by 42
Wani, M. S., Kretschmer, M., Schröder, B., Grebe, A., & Rademacher, M. (2024) · IEEE Open Journal of the Communications Society · doi:10.1109/ojcoms.2024.3430823 · Cited by 44
Metadata
- Authors
- Ladisa, P., Plate, H., Martinez, M., & Barais, O.
- Affiliations
- Systems, Applications & Products in Data Processing (Switzerland) (CH)
- Université Polytechnique Hauts-de-France
- Institut national de recherche en sciences et technologies du numérique (FR)
- Venue
- 2023 IEEE Symposium on Security and Privacy (SP)
- Publisher
- IEEE
- Published
- 2023-05
- Pages
- 1509-1526
- ISSN
- 1081-6011 (ISSN-L)
- OpenAlex
- W4385208592
- Cited by
- 208
- References
- 94
- Citations by year
- 2026: 65 · 2025: 63 · 2024: 46 · 2023: 32
- FWCI
- 52.94
- Type
- conference paper
- Language
- en
- Open access
- green
- inria.hal.science
- Locations
- IEEE Symposium on Security and Privacy (S&P) (publishedVersion)
- HAL (submittedVersion, cc-by)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Keywords
- attack taxonomy, supply chain attacks, malicious code injection, attack trees, software supply chain security, security measures, developer survey, attack vectors
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
