52 citations · 158 across the 17 of their papers we have counts for
3 papers · 1 filter
On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI
Piergiorgio Ladisa, Serena Elisa Ponta, Nicola Ronzoni +2
Current software supply chains heavily rely on open-source packages hosted in public repositories. Given the popularity of ecosystems like npm and PyPI, malicious users started to…
The Hitchhiker's Guide to Malicious Third-Party Dependencies
Piergiorgio Ladisa, Merve Sahin, Serena Elisa Ponta +3
The increasing popularity of certain programming languages has spurred the creation of ecosystem-specific package repositories and package managers. Such repositories (e.g., npm, P…
Journey to the Center of Software Supply Chain Attacks
Piergiorgio Ladisa, Serena Elisa Ponta, Antonino Sabetta +2
This work discusses open-source software supply chain attacks and proposes a general taxonomy describing how attackers conduct them. We then provide a list of safeguards to mitigat…