Cover Image

Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks

Fuente: arXiv

Saved in:

Bibliographic Details
Main Authors:	He, Hao, Vasilescu, Bogdan, Kästner, Christian
Format:	Preprint
Published:	2025
Subjects:	Software Engineering Cryptography and Security
Online Access:	Acceder al recurso
Tags:	Add Tag No Tags, Be the first to tag this record!

Similar Items

Six Million (Suspected) Fake Stars in GitHub: A Growing Spiral of Popularity Contests, Spams, and Malware
by: He, Hao, et al.
Published: (2024)

Defending Code Language Models against Backdoor Attacks with Deceptive Cross-Entropy Loss
by: Yang, Guang, et al.
Published: (2024)

Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order
by: Reyes, Frank, et al.
Published: (2024)

Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management
by: Schmid, Larissa, et al.
Published: (2026)

GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement
by: Cesarano, Carmine, et al.
Published: (2025)

Wolves in the Repository: A Software Engineering Analysis of the XZ Utils Supply Chain Attack
by: Przymus, Piotr, et al.
Published: (2025)

Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments
by: Zheng, Xinyi, et al.
Published: (2024)

QUT-DV25: A Dataset for Dynamic Analysis of Next-Gen Software Supply Chain Attacks
by: Mehedi, Sk Tanzir, et al.
Published: (2025)

How Can ChatGPT Support Human Security Testers to Help Mitigate Supply Chain Attacks?
by: Zhang, Ying, et al.
Published: (2023)

Software Supply Chain Security of Web3
by: Monperrus, Martin
Published: (2025)

Operationalizing Research Software for Supply Chain Security
by: Kalu, Kelechi G., et al.
Published: (2026)

Evaluating Software Supply Chain Security in Research Software
by: Hegewald, Richard, et al.
Published: (2025)

Securing the Software Package Supply Chain for Critical Systems
by: Murali, Ritwik, et al.
Published: (2025)

Dirty-Waters: Detecting Software Supply Chain Smells
by: Liu, Raphina, et al.
Published: (2024)

Defending against Adversarial Malware Attacks on ML-based Android Malware Detection Systems
by: He, Ping, et al.
Published: (2025)

Propagation-Based Vulnerability Impact Assessment for Software Supply Chains
by: Ruan, Bonan, et al.
Published: (2025)

Understanding the Supply Chain and Risks of Large Language Model Applications
by: Ma, Yujie, et al.
Published: (2025)

An Industry Interview Study of Software Signing for Supply Chain Security
by: Kalu, Kelechi G., et al.
Published: (2024)

Exploiting LLM Agent Supply Chains via Payload-less Skills
by: Liu, Xinyu, et al.
Published: (2026)

An Empirically Grounded Reference Architecture for Software Supply Chain Metadata Management
by: Tran, Nguyen Khoi, et al.
Published: (2023)

SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
by: Bufalino, Jacopo, et al.
Published: (2025)

Towards Predicting Multi-Vulnerability Attack Chains in Software Supply Chains from Software Bill of Materials Graphs
by: Baird, Laura, et al.
Published: (2026)

Demonstration Attack against In-Context Learning for Code Intelligence
by: Ge, Yifei, et al.
Published: (2024)

Software Bill of Materials in Software Supply Chain Security A Systematic Literature Review
by: O'Donoghue, Eric, et al.
Published: (2025)

SoK: Analysis of Software Supply Chain Security by Establishing Secure Design Properties
by: Okafor, Chinenye, et al.
Published: (2024)

On-Chain Analysis of Smart Contract Dependency Risks on Ethereum
by: Jin, Monica, et al.
Published: (2025)

ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain
by: Kalu, Kelechi G., et al.
Published: (2025)

OmniBOR: A System for Automatic, Verifiable Artifact Resolution across Software Supply Chains
by: Seshadri, Bharathi, et al.
Published: (2024)

Exposing and Defending Membership Leakage in Vulnerability Prediction Models
by: Liao, Yihan, et al.
Published: (2025)

A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Models
by: Casey, Beatrice, et al.
Published: (2024)

A Practical Adversarial Attack against Sequence-based Deep Learning Malware Classifiers
by: Tan, Kai, et al.
Published: (2025)

ARGUS: Defending LLM Agents Against Context-Aware Prompt Injection
by: Weng, Shihao, et al.
Published: (2026)

Patch2QL: Discover Cognate Defects in Open Source Software Supply Chain With Auto-generated Static Analysis Rules
by: Wang, Fuwei, et al.
Published: (2024)

Bomfather: An eBPF-based Kernel-level Monitoring Framework for Accurate Identification of Unknown, Unused, and Dynamically Loaded Dependencies in Modern Software Supply Chains
by: Srinivasan, Naveen, et al.
Published: (2025)

Identifying the Supply Chain of AI for Trustworthiness and Risk Management in Critical Applications
by: Sheh, Raymond K., et al.
Published: (2025)

The Power of Words: Generating PowerShell Attacks from Natural Language
by: Liguori, Pietro, et al.
Published: (2024)

Large Language Model Supply Chain: Open Problems From the Security Perspective
by: Hu, Qiang, et al.
Published: (2024)

Beyond the Protocol: Unveiling Attack Vectors in the Model Context Protocol (MCP) Ecosystem
by: Song, Hao, et al.
Published: (2025)

From Transactions to Exploits: Automated PoC Synthesis for Real-World DeFi Attacks
by: Su, Xing, et al.
Published: (2026)

CVE Breadcrumbs: Tracking Vulnerabilities Through Versioned Apache Libraries
by: Garcia, Derek, et al.
Published: (2025)