On the public citation graph
Towards Measuring Supply Chain Attacks on Package Managers for Interpreted Languages
0 signed · 132 inferred · view as graph
Inferred edges come from two machine sources: sweeps of open repository metadata (mostly SSRN and Zenodo), and a bulk OpenAlex citation snapshot. Every row below is labelled with the one it came from. Neither is a complete citation index — absence here is not evidence of absence.
Is this your work? Sign in with ORCID and put your name on the
claims that are yours.
Reference health. See whether every reference in this work resolves to a
known work and none has been retracted — and get a dated CiteStamped
badge you can embed.
What this work says
Outgoing claims: the papers this work cites, builds on, or argues with.
inferredcites →https://doi.org/10.1109/icctict.2016.7514657openalex-snapshot
Evolution of evasive malwares: A survey
inferredcites →https://doi.org/10.1109/icicip.2014.7010353openalex-snapshot
Survey on malware anti-analysis
inferredcites →https://doi.org/10.1109/icse-nier.2019.00012openalex-snapshot
Detecting Suspicious Package Updates
inferredcites →https://doi.org/10.1109/secdev.2017.14openalex-snapshot
Angr - The Next Generation of Binary Analysis
inferredcites →https://doi.org/10.1109/sp.2016.30openalex-snapshot
TriggerScope: Towards Detecting Logic Bombs in Android Applications
inferredcites →https://doi.org/10.1145/2635868.2635913openalex-snapshot
SymJS: automatic symbolic testing of JavaScript web applications
inferredcites →https://doi.org/10.1145/3196398.3196401openalex-snapshot
On the impact of security vulnerabilities in the npm package dependency network
inferredcites →https://doi.org/10.13140/2.1.1324.2249openalex-snapshot
Hulk: Eliciting Malicious Behavior in Browser Extensions
inferredcites →https://doi.org/10.14722/ndss.2018.23071openalex-snapshot
SYNODE: Understanding and Automatically Preventing Injection Attacks on NODE.JS
inferredcites →https://doi.org/10.14722/ndss.2018.23131openalex-snapshot
BreakApp: Automated, Flexible Application Compartmentalization
inferredcites →https://doi.org/10.48550/arxiv.1902.09217openalex-snapshot
Small World with High Risks: A Study of Security Threats in the npm Ecosystem
inferredcites →https://doi.org/10.60882/cispa.24612984openalex-snapshot
HideNoSeek: Camouflaging Malicious JavaScript in Benign ASTs
inferredcites →https://doi.org/10.60882/cispa.32771274openalex-snapshot
Freezing the Web: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers.
What points at this work
Incoming claims: where this work appears in other papers’ reference lists and arguments.
inferred← citeshttps://doi.org/10.1002/smr.70159openalex-snapshot
Security Assessment of Private Package Repositories: An Experience on Acc‐Py at CERN
inferred← citeshttps://doi.org/10.1007/978-3-030-87839-9_6openalex-snapshot
A Survey on Common Threats in npm and PyPi Registries
inferred← citeshttps://doi.org/10.1007/978-3-031-76273-4_8openalex-snapshot
An Analysis of Malicious Behaviors of Open-Source Packages Using Dynamic Analysis
inferred← citeshttps://doi.org/10.1007/978-3-031-85849-9_29openalex-snapshot
npmSECO: A Tool for Integrating Trust into the Software Ecosystem
inferred← citeshttps://doi.org/10.1007/978-3-031-96590-6_18openalex-snapshot
Metadata Assisted Supply-Chain Attack Detection for Ansible
inferred← citeshttps://doi.org/10.1007/978-3-032-35576-8_2openalex-snapshot
Leveraging Code Slicing for LLMs-Based Malicious NPM Package Detection
inferred← citeshttps://doi.org/10.1007/978-3-032-35586-7_17openalex-snapshot
From Fake Job Offer to Full Environment Compromise: Anatomy of the Contagious Interview Campaign
inferred← citeshttps://doi.org/10.1007/978-981-96-1797-5_3openalex-snapshot
Common Types of Dependency Issues
inferred← citeshttps://doi.org/10.1007/978-981-96-3531-3_8openalex-snapshot
You Can’t Touch This: Detecting Typosquatting Packages for Enhanced Malware Prevention in Software Supply Chains
inferred← citeshttps://doi.org/10.1007/s10664-022-10238-yopenalex-snapshot
A systematic literature review on trust in the software ecosystem
inferred← citeshttps://doi.org/10.1007/s10664-024-10523-yopenalex-snapshot
Dependabot and security pull requests: large empirical study
inferred← citeshttps://doi.org/10.1007/s44443-026-01121-7openalex-snapshot
PDCG-RuleDetector: parameterized data-flow call graphs meet large language models for malicious NPM package detection
inferred← citeshttps://doi.org/10.1016/j.cose.2024.103977openalex-snapshot
OSSIntegrity: Collaborative open-source code integrity verification
inferred← citeshttps://doi.org/10.1016/j.fsidi.2023.301508openalex-snapshot
On the prevalence of software supply chain attacks: Empirical study and investigative framework
inferred← citeshttps://doi.org/10.1016/j.jisa.2025.104032openalex-snapshot
PypiGuard: A novel meta-learning approach for enhanced malicious package detection in PyPI through static-dynamic feature fusion
inferred← citeshttps://doi.org/10.1093/comjnl/bxaf029openalex-snapshot
Advanced code slicing with pre-trained model fine-tuned for open-source component malware detection
inferred← citeshttps://doi.org/10.1109/access.2026.3732697openalex-snapshot
Malicious Repository Detection Using Transformer-Based Models: A Metadata-Driven Approach
inferred← citeshttps://doi.org/10.1109/aiware69974.2025.00008openalex-snapshot
CHASE: LLM Agents for Dissecting Malicious PyPI Packages
inferred← citeshttps://doi.org/10.1109/ase56229.2023.00073openalex-snapshot
MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains
inferred← citeshttps://doi.org/10.1109/ase56229.2023.00085openalex-snapshot
A Needle is an Outlier in a Haystack: Hunting Malicious PyPI Packages with Code Clustering
inferred← citeshttps://doi.org/10.1109/ase56229.2023.00135openalex-snapshot
An Empirical Study of Malicious Code In PyPI Ecosystem
inferred← citeshttps://doi.org/10.1109/ase63991.2025.00042openalex-snapshot
ProfMal: Detecting Malicious NPM Packages by the Synergy between Static and Dynamic Analysis
inferred← citeshttps://doi.org/10.1109/ast58925.2023.00009openalex-snapshot
AutoMetric: Towards Measuring Open-Source Software Quality Metrics Automatically
inferred← citeshttps://doi.org/10.1109/dsc67331.2025.00043openalex-snapshot
ACCI: A Multi-Feature PyPI Package Anomaly Detection Method Based on Script Deep Semantics
inferred← citeshttps://doi.org/10.1109/dsc67331.2025.00044openalex-snapshot
MalGuard: Malicious Package Detection Based on Dual Validation of Rule Scanning and Large Language Model
inferred← citeshttps://doi.org/10.1109/dsn64029.2025.00043openalex-snapshot
What Lies Beneath: An Empirical Study of Silent Vulnerability Fixes in Open-Source Software
inferred← citeshttps://doi.org/10.1109/dsn64029.2025.00045openalex-snapshot
An Analysis of Malicious Packages in Open-Source Software in the Wild
inferred← citeshttps://doi.org/10.1109/dsn64029.2025.00072openalex-snapshot
Automatically Generating Rules of Malicious Software Packages via Large Language Model
inferred← citeshttps://doi.org/10.1109/etaact69135.2026.11542038openalex-snapshot
CloudImageHunt: Large-Scale Detection and Analysis of Malicious Container Images
inferred← citeshttps://doi.org/10.1109/eurosp57164.2023.00036openalex-snapshot
Finding Fixed Vulnerabilities with Off-the-Shelf Static Analysis
inferred← citeshttps://doi.org/10.1109/eurosp57164.2023.00068openalex-snapshot
NodeMedic: End-to-End Analysis of Node.js Vulnerabilities with Provenance Graphs
inferred← citeshttps://doi.org/10.1109/forge66646.2025.00021openalex-snapshot
Vulnerability-Triggering Test Case Generation from Third-Party Libraries
inferred← citeshttps://doi.org/10.1109/icftic68075.2025.11324695openalex-snapshot
Interpretable Recognition and Classification of Malicious Packages based on the LIME Algorithm
inferred← citeshttps://doi.org/10.1109/icisaa62385.2024.10829139openalex-snapshot
AAF-SCM: An Authenticated Framework for Supply Chain Management
inferred← citeshttps://doi.org/10.1109/icitsif69060.2026.11609160openalex-snapshot
Guardnpm: Automated Identification of Malicious NPM Dependencies
inferred← citeshttps://doi.org/10.1109/icoa66896.2025.11236532openalex-snapshot
Broken Trust in Open-Source Ecosystems: The Risks of Third-Party Packages in npm and PyPI
inferred← citeshttps://doi.org/10.1109/icse-companion58688.2023.00068openalex-snapshot
Software Supply Chain Risk Assessment Framework
inferred← citeshttps://doi.org/10.1109/icse-seip55303.2022.9794068openalex-snapshot
What are Weak Links in the npm Supply Chain?
inferred← citeshttps://doi.org/10.1109/icse-seip66354.2025.00024openalex-snapshot
Detecting Python Malware in the Software Supply Chain with Program Analysis
inferred← citeshttps://doi.org/10.1109/icse48619.2023.00052openalex-snapshot
Bad Snakes: Understanding and Improving Python Package Index Malware Scanning
inferred← citeshttps://doi.org/10.1109/icse48619.2023.00095openalex-snapshot
Understanding the Threats of Upstream Vulnerabilities to Downstream Projects in the Maven Ecosystem
inferred← citeshttps://doi.org/10.1109/icse48619.2023.00096openalex-snapshot
SecBench.js: An Executable Security Benchmark Suite for Server-Side JavaScript
inferred← citeshttps://doi.org/10.1109/icse55347.2025.00054openalex-snapshot
Understanding and Detecting Peer Dependency Resolving Loop in npm Ecosystem
inferred← citeshttps://doi.org/10.1109/icse55347.2025.00146openalex-snapshot
Leveraging Large Language Models to Detect NPM Malicious Packages
inferred← citeshttps://doi.org/10.1109/icse55347.2025.00147openalex-snapshot
Exposing the Hidden Layer: Software Repositories in the Service of Seo Manipulation
inferred← citeshttps://doi.org/10.1109/icsme64153.2025.00044openalex-snapshot
Security Vulnerabilities in Docker Images: A Cross-Tag Study of Application Dependencies
inferred← citeshttps://doi.org/10.1109/isdfs60797.2024.10527288openalex-snapshot
Securing Artificial Intelligence: Exploring Attack Scenarios and Defense Strategies
inferred← citeshttps://doi.org/10.1109/issre66568.2025.00051openalex-snapshot
Detection and Analysis of Poisoned Image in Container Registry
inferred← citeshttps://doi.org/10.1109/jiot.2025.3528744openalex-snapshot
Advanced Persistent Threats Based on Supply Chain Vulnerabilities: Challenges, Solutions, and Future Directions
inferred← citeshttps://doi.org/10.1109/mc.2022.3190801openalex-snapshot
Invisible Supply Chain Attacks Based on Trojan Source
inferred← citeshttps://doi.org/10.1109/mcna69896.2026.11574373openalex-snapshot
TRACESEC: Trace-Aware Neuro-Symbolic Vulnerability Reasoning for Software Supply-Chain Security
inferred← citeshttps://doi.org/10.1109/qpain69676.2026.11545547openalex-snapshot
Revisiting the QUT-DV25 Benchmark: Interpretable Feature-Fused Models for PyPI Malware Detection
inferred← citeshttps://doi.org/10.1109/raid67961.2025.00047openalex-snapshot
Evaluating LLM-Based Detection of Malicious Package Updates in npm
inferred← citeshttps://doi.org/10.1109/rew72749.2026.00036openalex-snapshot
A Stage-Aware Requirements-To-Evidence Framework for Secure CI/CD Pipelines
inferred← citeshttps://doi.org/10.1109/sami68106.2026.11420337openalex-snapshot
Analyzing the Security Implications of Extensible Configuration Files : * A Case Study on VIM Dotfiles and Command Execution Risk
inferred← citeshttps://doi.org/10.1109/secdev61143.2024.00017openalex-snapshot
GENIE: Guarding the npm Ecosystem with Semantic Malware Detection
inferred← citeshttps://doi.org/10.1109/sp46215.2023.10179304openalex-snapshot
SoK: Taxonomy of Attacks on Open-Source Software Supply Chains
inferred← citeshttps://doi.org/10.1109/sp46215.2023.10179332openalex-snapshot
Investigating Package Related Security Threats in Software Registries
inferred← citeshttps://doi.org/10.1109/sp46215.2023.10179352openalex-snapshot
Scaling JavaScript Abstract Interpretation to Detect and Exploit Node.js Taint-style Vulnerability
inferred← citeshttps://doi.org/10.1109/sp46215.2023.10179471openalex-snapshot
Continuous Intrusion: Characterizing the Security of Continuous Integration Services
inferred← citeshttps://doi.org/10.1109/sp54263.2024.00183openalex-snapshot
Jasmine: Scale up JavaScript Static Security Analysis with Computation-based Semantic Explanation
inferred← citeshttps://doi.org/10.1109/sp61157.2025.00195openalex-snapshot
CoinDef: A Comprehensive Code Injection Defense for the Electron Framework
inferred← citeshttps://doi.org/10.1109/sp63933.2026.00108openalex-snapshot
The First Large-Scale Systematic Study of Python Class Pollution Vulnerability
inferred← citeshttps://doi.org/10.1109/sp63933.2026.00227openalex-snapshot
Death Is Not the End: a Longitudinal Study on the Impact of Automatic Updates on Container Vulnerability Lifespans
inferred← citeshttps://doi.org/10.1109/tele71748.2026.11591271openalex-snapshot
Prevention and Dynamic Analysis of Supply Chain Attacks in Academic Python Environments
inferred← citeshttps://doi.org/10.1109/tifs.2025.3580336openalex-snapshot
MalPacDetector: An LLM-Based Malicious NPM Package Detector
inferred← citeshttps://doi.org/10.1109/tifs.2026.3654388openalex-snapshot
DySec: A Machine Learning-Based Dynamic Analysis for Detecting Malicious Packages in PyPI Ecosystem
inferred← citeshttps://doi.org/10.1109/tifs.2026.3714264openalex-snapshot
Toward Reliable Malicious JavaScript Detection in Obfuscated Code
inferred← citeshttps://doi.org/10.1109/tnse.2023.3260880openalex-snapshot
Vulnerability of Package Dependency Networks
inferred← citeshttps://doi.org/10.1109/tnsm.2025.3531040openalex-snapshot
Elastic Cross-Layer Orchestration of Network Policies in the Kubernetes Stack
inferred← citeshttps://doi.org/10.1109/ton.2025.3566903openalex-snapshot
Your Botnet Is His Botnet? A Deep Dive Into the Supply Chain Attack Against Cyber-Arm Industry
inferred← citeshttps://doi.org/10.1109/tr.2026.3676895openalex-snapshot
Snake in the Grass: A Hybrid Detection Method Targeting Malicious PyPI Packages
inferred← citeshttps://doi.org/10.1109/trustcom53373.2021.00091openalex-snapshot
Malicious Packages Lurking in User-Friendly Python Package Index
inferred← citeshttps://doi.org/10.1109/trustcom63139.2024.00269openalex-snapshot
Maldet: An Automated Malicious npm Package Detector Based on Behavior Characteristics and Attack Vectors
inferred← citeshttps://doi.org/10.1109/tse.2023.3319509openalex-snapshot
Are Your Dependencies Code Reviewed?: Measuring Code Review Coverage in Dependency Updates
inferred← citeshttps://doi.org/10.1109/tse.2025.3599732openalex-snapshot
Wolf in Sheep’s Clothing: Shearing the Camouflage of Malicious Java Components in Maven
inferred← citeshttps://doi.org/10.1109/tse.2025.3618952openalex-snapshot
Detecting Malicious Packages in PyPI and NPM by Clustering Installation Scripts
inferred← citeshttps://doi.org/10.1109/tse.2025.3633280openalex-snapshot
Synthetic Malware at Scale: Malicious Code Generation With Code Transplanting
inferred← citeshttps://doi.org/10.1145/3510003.3510104openalex-snapshot
Practical automated detection of malicious npm packages
inferred← citeshttps://doi.org/10.1145/3510457.3513044openalex-snapshot
What are weak links in the npm supply chain?
inferred← citeshttps://doi.org/10.1145/3551349.3560419openalex-snapshot
Leveraging Practitioners’ Feedback to Improve a Security Linter
inferred← citeshttps://doi.org/10.1145/3579856.3595799openalex-snapshot
Cage4Deno: A Fine-Grained Sandbox for Deno Subprocesses
inferred← citeshttps://doi.org/10.1145/3597503.3639199openalex-snapshot
RogueOne: Detecting Rogue Updates via Differential Data-flow Analysis Using Trust Domains
inferred← citeshttps://doi.org/10.1145/3605770.3625212openalex-snapshot
The Hitchhiker's Guide to Malicious Third-Party Dependencies
inferred← citeshttps://doi.org/10.1145/3630253openalex-snapshot
On Detecting and Measuring Exploitable JavaScript Functions in Real-world Applications
inferred← citeshttps://doi.org/10.1145/3650212.3680397openalex-snapshot
Maltracker: A Fine-Grained NPM Malware Tracker Copiloted by LLM-Enhanced Dataset
inferred← citeshttps://doi.org/10.1145/3689944.3696168openalex-snapshot
What's in a URL? An Analysis of Hardcoded URLs in npm Packages
inferred← citeshttps://doi.org/10.1145/3691620.3695493openalex-snapshot
1+1>2: Integrating Deep Code Behaviors with Metadata Features for Malicious PyPI Package Detection
inferred← citeshttps://doi.org/10.1145/3698396openalex-snapshot
AttackDefense Framework (ADF): Enhancing IoT Devices and Lifecycles Threat Modeling
inferred← citeshttps://doi.org/10.1145/3714464openalex-snapshot
Research Directions in Software Supply Chain Security
inferred← citeshttps://doi.org/10.1145/3733827.3765527openalex-snapshot
Spilling the Tea: Uncovering TEA Token Abuse in npm
inferred← citeshttps://doi.org/10.1145/3733827.3765531openalex-snapshot
ORCA: Unveiling Obscure Containers In The Wild
inferred← citeshttps://doi.org/10.1145/3744916.3773113openalex-snapshot
IntelliRadar: A Comprehensive Platform to Pinpoint Malicious Packages from Cyber Intelligence
inferred← citeshttps://doi.org/10.1145/3744916.3787763openalex-snapshot
Depradar: Agentic Coordination for Context-Aware Defect Impact Analysis in Deep Learning Libraries
inferred← citeshttps://doi.org/10.1145/3800506.3803487openalex-snapshot
VSMEx: A Collection Tool and a Dataset of Malicious VS Code Extensions: Data/Toolset Paper
inferred← citeshttps://doi.org/10.1145/3808217openalex-snapshot
Uncovering Similar but Different Packages in PyPI and Potential Security Threats
inferred← citeshttps://doi.org/10.1145/3839494openalex-snapshot
Fighting Supply Chain Attacks with Effect Systems
inferred← citeshttps://doi.org/10.1155/2022/1176898openalex-snapshot
Code Vulnerability Detection Based on Deep Sequence and Graph Models: A Survey
inferred← citeshttps://doi.org/10.1365/s43439-023-00095-wopenalex-snapshot
The evolution of ransomware attacks in light of recent cyber threats. How can geopolitical conflicts influence the cyber climate?
inferred← citeshttps://doi.org/10.14722/madweb.2022.23001openalex-snapshot
What the Fork? Finding and Analyzing Malware in GitHub Forks
inferred← citeshttps://doi.org/10.14722/ndss.2023.24610openalex-snapshot
CHKPLUG: Checking GDPR Compliance of WordPress Plugins via Cross-language Code Property Graph
inferred← citeshttps://doi.org/10.2139/ssrn.4901397openalex-snapshot
On the Risks and Security of Software Updates: A Systematic Literature Review
inferred← citeshttps://doi.org/10.2139/ssrn.7592667openalex-snapshot
Malicious packages in public registries: reporting bias, detection coverage, and the limits of evaluating registry interventions
inferred← citeshttps://doi.org/10.22028/d291-47505openalex-snapshot
Bilingual Problems: Studying the Security Risks Incurred by Native Extensions in Scripting Languages
inferred← citeshttps://doi.org/10.24018/ejeng.2024.9.6.3199openalex-snapshot
Static Security Assessment: A Case Study of the Saudi National Grid
inferred← citeshttps://doi.org/10.3233/ssw220015openalex-snapshot
Plow: A Novel Approach to Interlinking Modular Ontologies Based on Software Package Management
inferred← citeshttps://doi.org/10.3390/jcp6050160openalex-snapshot
Metadata Compressibility and Evaluation Bias in Malicious Package Detection for NPM and PyPI
inferred← citeshttps://doi.org/10.3390/math11234856openalex-snapshot
Construction of Software Supply Chain Threat Portrait Based on Chain Perspective
inferred← citeshttps://doi.org/10.3390/math14183250openalex-snapshot
Cost-Aware Coalition Formation in Multi-Defender Network Security Games: Mathematical Modeling and Optimization
inferred← citeshttps://doi.org/10.48550/arxiv.2005.03823openalex-snapshot
Blind Backdoors in Deep Learning Models
inferred← citeshttps://doi.org/10.48550/arxiv.2209.13288openalex-snapshot
A Benchmark Comparison of Python Malware Detection Approaches
inferred← citeshttps://doi.org/10.5281/zenodo.13855569openalex-snapshot
You Can't Touch This: Detecting Typosquatting Packages for Enhanced Malware Prevention in Software Supply Chains
inferred← citeshttps://doi.org/10.70675/70265dd7z4bbdz41c2za9f2zbfed786b5894openalex-snapshot
Understanding and preventing open-source software supply chain attacks
inferred← citeshttps://doi.org/10.7717/peerj-cs.1838openalex-snapshot
Vulnerable JavaScript functions detection using stacking of convolutional neural networks
Editorial review for independent work. ICSAC — the Institute for Complexity
Science and Advanced Computing — runs a structured editorial panel for researchers
publishing outside journals, and publishes on CiteStamp rails. Submission is free
and goes through ORCID: icsacinstitute.org/submit.