22 citations · 34 across the 4 of their papers we have counts for
5 papers
On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI
Piergiorgio Ladisa, Serena Elisa Ponta, Nicola Ronzoni +2
Current software supply chains heavily rely on open-source packages hosted in public repositories. Given the popularity of ecosystems like npm and PyPI, malicious users started to…
The Hitchhiker's Guide to Malicious Third-Party Dependencies
Piergiorgio Ladisa, Merve Sahin, Serena Elisa Ponta +3
The increasing popularity of certain programming languages has spurred the creation of ecosystem-specific package repositories and package managers. Such repositories (e.g., npm, P…
Journey to the Center of Software Supply Chain Attacks
Piergiorgio Ladisa, Serena Elisa Ponta, Antonino Sabetta +2
This work discusses open-source software supply chain attacks and proposes a general taxonomy describing how attackers conduct them. We then provide a list of safeguards to mitigat…
Towards the Detection of Malicious Java Packages
Piergiorgio Ladisa, Henrik Plate, Matias Martinez +2
Open-source software supply chain attacks aim at infecting downstream users by poisoning open-source packages. The common way of consuming such artifacts is through package reposit…
Taxonomy of Attacks on Open-Source Software Supply Chains
Piergiorgio Ladisa, Henrik Plate, Matias Martinez +1
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today's open-source suppl…