most citedPinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks

6 citations · 6 across the 1 of their papers we have counts for

collaborators

1 paper

cs.SE2025★ 6 cited

Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks

Hao He, Bogdan Vasilescu, Christian Kästner

Recent high-profile incidents in open-source software have greatly raised practitioner attention on software supply chain attacks. To guard against potential malicious package upda…