{"id":"https://openalex.org/W4384808064","doi":"https://doi.org/10.1145/3605770.3625212","title":"The Hitchhiker's Guide to Malicious Third-Party Dependencies","display_name":"The Hitchhiker's Guide to Malicious Third-Party Dependencies","publication_year":2023,"publication_date":"2023-11-23","ids":{"openalex":"https://openalex.org/W4384808064","doi":"https://doi.org/10.1145/3605770.3625212"},"language":"en","primary_location":{"id":"doi:10.1145/3605770.3625212","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605770.3625212","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605770.3625212","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3605770.3625212","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5006458254","display_name":"Piergiorgio Ladisa","orcid":"https://orcid.org/0000-0003-0850-4054"},"institutions":[{"id":"https://openalex.org/I2802519937","display_name":"Institut de Recherche en Informatique et Syst\u00e8mes Al\u00e9atoires","ror":"https://ror.org/00myn0z94","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I205703379","https://openalex.org/I2802204017","https://openalex.org/I2802519937","https://openalex.org/I28221208","https://openalex.org/I4210127572","https://openalex.org/I4210159245","https://openalex.org/I56067802"]},{"id":"https://openalex.org/I4210133614","display_name":"Systems, Applications & Products in Data Processing (United Kingdom)","ror":"https://ror.org/04k7gd586","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210132444","https://openalex.org/I4210133614"]}],"countries":["FR","GB"],"is_corresponding":false,"raw_author_name":"Piergiorgio Ladisa","raw_affiliation_strings":["SAP Security Research & Universit\u00e9 de Rennes 1, INRIA/IRISA, Mougins, France","Diversity-centric Software Engineering","SAP Research [Sophia Antipolis]"],"raw_orcid":"https://orcid.org/0000-0003-0850-4054","affiliations":[{"raw_affiliation_string":"SAP Security Research & Universit\u00e9 de Rennes 1, INRIA/IRISA, Mougins, France","institution_ids":["https://openalex.org/I2802519937"]},{"raw_affiliation_string":"Diversity-centric Software Engineering","institution_ids":[]},{"raw_affiliation_string":"SAP Research [Sophia Antipolis]","institution_ids":["https://openalex.org/I4210133614"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101821772","display_name":"Merve \u015eahin","orcid":"https://orcid.org/0009-0009-4798-0601"},"institutions":[{"id":"https://openalex.org/I4210133614","display_name":"Systems, Applications & Products in Data Processing (United Kingdom)","ror":"https://ror.org/04k7gd586","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210132444","https://openalex.org/I4210133614"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Merve Sahin","raw_affiliation_strings":["SAP Security Research, Mougins, France","SAP Research [Sophia Antipolis]"],"raw_orcid":"https://orcid.org/0009-0009-4798-0601","affiliations":[{"raw_affiliation_string":"SAP Security Research, Mougins, France","institution_ids":[]},{"raw_affiliation_string":"SAP Research [Sophia Antipolis]","institution_ids":["https://openalex.org/I4210133614"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5035492762","display_name":"Serena Elisa Ponta","orcid":"https://orcid.org/0000-0002-6208-4743"},"institutions":[{"id":"https://openalex.org/I4210133614","display_name":"Systems, Applications & Products in Data Processing (United Kingdom)","ror":"https://ror.org/04k7gd586","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210132444","https://openalex.org/I4210133614"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Serena Elisa Ponta","raw_affiliation_strings":["SAP Security Research, Mougins, France","SAP Research [Sophia Antipolis]"],"raw_orcid":"https://orcid.org/0000-0002-6208-4743","affiliations":[{"raw_affiliation_string":"SAP Security Research, Mougins, France","institution_ids":[]},{"raw_affiliation_string":"SAP Research [Sophia Antipolis]","institution_ids":["https://openalex.org/I4210133614"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082204583","display_name":"Marco Rosa","orcid":"https://orcid.org/0000-0002-4614-6932"},"institutions":[{"id":"https://openalex.org/I4210133614","display_name":"Systems, Applications & Products in Data Processing (United Kingdom)","ror":"https://ror.org/04k7gd586","country_code":"GB","type":"company","lineage":["https://openalex.org/I4210132444","https://openalex.org/I4210133614"]}],"countries":["GB"],"is_corresponding":false,"raw_author_name":"Marco Rosa","raw_affiliation_strings":["SAP Security Research, Mougins, France","SAP Research [Sophia Antipolis]"],"raw_orcid":"https://orcid.org/0000-0002-4614-6932","affiliations":[{"raw_affiliation_string":"SAP Security Research, Mougins, France","institution_ids":[]},{"raw_affiliation_string":"SAP Research [Sophia Antipolis]","institution_ids":["https://openalex.org/I4210133614"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100762798","display_name":"Mat\u00edas Mart\u00ednez","orcid":"https://orcid.org/0000-0002-2945-866X"},"institutions":[{"id":"https://openalex.org/I9617848","display_name":"Universitat Polit\u00e8cnica de Catalunya","ror":"https://ror.org/03mb6wj31","country_code":"ES","type":"education","lineage":["https://openalex.org/I9617848"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Matias Martinez","raw_affiliation_strings":["Universitat Polit\u00e8cnica de Catalunya - Barcelona Tech, Barcelona, Spain","Universitat Polit\u00e8cnica de Catalunya [Barcelona]"],"raw_orcid":"https://orcid.org/0000-0002-2945-866X","affiliations":[{"raw_affiliation_string":"Universitat Polit\u00e8cnica de Catalunya - Barcelona Tech, Barcelona, Spain","institution_ids":["https://openalex.org/I9617848"]},{"raw_affiliation_string":"Universitat Polit\u00e8cnica de Catalunya [Barcelona]","institution_ids":["https://openalex.org/I9617848"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5002785466","display_name":"Olivier Barais","orcid":"https://orcid.org/0000-0002-4551-8562"},"institutions":[{"id":"https://openalex.org/I1326498283","display_name":"Institut national de recherche en sciences et technologies du num\u00e9rique","ror":"https://ror.org/02kvxyf05","country_code":"FR","type":"government","lineage":["https://openalex.org/I1326498283"]},{"id":"https://openalex.org/I2802519937","display_name":"Institut de Recherche en Informatique et Syst\u00e8mes Al\u00e9atoires","ror":"https://ror.org/00myn0z94","country_code":"FR","type":"facility","lineage":["https://openalex.org/I1294671590","https://openalex.org/I1294671590","https://openalex.org/I1326498283","https://openalex.org/I205703379","https://openalex.org/I2802204017","https://openalex.org/I2802519937","https://openalex.org/I28221208","https://openalex.org/I4210127572","https://openalex.org/I4210159245","https://openalex.org/I56067802"]},{"id":"https://openalex.org/I56067802","display_name":"Universit\u00e9 de Rennes","ror":"https://ror.org/015m7wh34","country_code":"FR","type":"education","lineage":["https://openalex.org/I56067802"]}],"countries":["FR"],"is_corresponding":false,"raw_author_name":"Olivier Barais","raw_affiliation_strings":["Universit\u00e9 de Rennes 1, INRIA/IRISA, Rennes, France","Diversity-centric Software Engineering"],"raw_orcid":"https://orcid.org/0000-0002-4551-8562","affiliations":[{"raw_affiliation_string":"Universit\u00e9 de Rennes 1, INRIA/IRISA, Rennes, France","institution_ids":["https://openalex.org/I1326498283","https://openalex.org/I2802519937","https://openalex.org/I56067802"]},{"raw_affiliation_string":"Diversity-centric Software Engineering","institution_ids":[]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":2.7642,"has_fulltext":true,"cited_by_count":12,"citation_normalized_percentile":{"value":0.93368421,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":89,"max":99},"biblio":{"volume":null,"issue":null,"first_page":"65","last_page":"74"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.9958000183105469,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8821609616279602},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.5858593583106995},{"id":"https://openalex.org/keywords/implementation","display_name":"Implementation","score":0.5485509037971497},{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.536338746547699},{"id":"https://openalex.org/keywords/evasion","display_name":"Evasion (ethics)","score":0.5148441195487976},{"id":"https://openalex.org/keywords/taint-checking","display_name":"Taint checking","score":0.49476760625839233},{"id":"https://openalex.org/keywords/plug-in","display_name":"Plug-in","score":0.4849960505962372},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4745415151119232},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.4606613516807556},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.44124293327331543},{"id":"https://openalex.org/keywords/popularity","display_name":"Popularity","score":0.4302843511104584},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.399557888507843},{"id":"https://openalex.org/keywords/database","display_name":"Database","score":0.3603286147117615},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.2773584723472595}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8821609616279602},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.5858593583106995},{"id":"https://openalex.org/C26713055","wikidata":"https://www.wikidata.org/wiki/Q245962","display_name":"Implementation","level":2,"score":0.5485509037971497},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.536338746547699},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.5148441195487976},{"id":"https://openalex.org/C63116202","wikidata":"https://www.wikidata.org/wiki/Q7676227","display_name":"Taint checking","level":3,"score":0.49476760625839233},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.4849960505962372},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4745415151119232},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.4606613516807556},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.44124293327331543},{"id":"https://openalex.org/C2780586970","wikidata":"https://www.wikidata.org/wiki/Q1357284","display_name":"Popularity","level":2,"score":0.4302843511104584},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.399557888507843},{"id":"https://openalex.org/C77088390","wikidata":"https://www.wikidata.org/wiki/Q8513","display_name":"Database","level":1,"score":0.3603286147117615},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.2773584723472595},{"id":"https://openalex.org/C8891405","wikidata":"https://www.wikidata.org/wiki/Q1059","display_name":"Immune system","level":2,"score":0.0},{"id":"https://openalex.org/C77805123","wikidata":"https://www.wikidata.org/wiki/Q161272","display_name":"Social psychology","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.0},{"id":"https://openalex.org/C203014093","wikidata":"https://www.wikidata.org/wiki/Q101929","display_name":"Immunology","level":1,"score":0.0}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1145/3605770.3625212","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605770.3625212","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605770.3625212","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:2307.09087","is_oa":true,"landing_page_url":"http://arxiv.org/abs/2307.09087","pdf_url":"https://arxiv.org/pdf/2307.09087","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:HAL:hal-04423802v1","is_oa":true,"landing_page_url":"https://inria.hal.science/hal-04423802","pdf_url":"https://inria.hal.science/hal-04423802/document","source":{"id":"https://openalex.org/S4306402512","display_name":"HAL (Le Centre pour la Communication Scientifique Directe)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1294671590","host_organization_name":"Centre National de la Recherche Scientifique","host_organization_lineage":["https://openalex.org/I1294671590"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"CCS 2023 - ACM SIGSAC Conference on Computer and Communications Security, Nov 2023, Copenhagen, Denmark. pp.65-74, ⟨10.1145/3605770.3625212⟩","raw_type":"info:eu-repo/semantics/conferenceObject"},{"id":"pmh:oai:upcommons.upc.edu:2117/425095","is_oa":true,"landing_page_url":"https://hdl.handle.net/2117/425095","pdf_url":null,"source":{"id":"https://openalex.org/S4377196262","display_name":"UPCommons institutional repository (Universitat Polit\u00e8cnica de Catalunya)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I9617848","host_organization_name":"Universitat Polit\u00e8cnica de Catalunya","host_organization_lineage":["https://openalex.org/I9617848"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-nc-nd","license_id":"https://openalex.org/licenses/cc-by-nc-nd","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Conference report"}],"best_oa_location":{"id":"doi:10.1145/3605770.3625212","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3605770.3625212","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3605770.3625212","source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2023 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4384808064.pdf","grobid_xml":"https://content.openalex.org/works/W4384808064.grobid-xml"},"referenced_works_count":17,"referenced_works":["https://openalex.org/W1892063863","https://openalex.org/W1984233424","https://openalex.org/W2024170198","https://openalex.org/W2146567535","https://openalex.org/W2314464932","https://openalex.org/W2528747608","https://openalex.org/W2742244373","https://openalex.org/W3046453918","https://openalex.org/W3138230581","https://openalex.org/W4226410005","https://openalex.org/W4226416841","https://openalex.org/W4281390800","https://openalex.org/W4286889240","https://openalex.org/W4301163492","https://openalex.org/W4308562473","https://openalex.org/W4308562662","https://openalex.org/W4405098069"],"related_works":["https://openalex.org/W2783112941","https://openalex.org/W4387298227","https://openalex.org/W2526398307","https://openalex.org/W2470029541","https://openalex.org/W4387065217","https://openalex.org/W4368275542","https://openalex.org/W4285357721","https://openalex.org/W2470502009","https://openalex.org/W3152957156","https://openalex.org/W2135891363"],"abstract_inverted_index":{"The":[0],"increasing":[1],"popularity":[2],"of":[3,11,86,111],"certain":[4],"programming":[5],"languages":[6,91],"has":[7],"spurred":[8],"the":[9,48,109,130,142],"creation":[10],"ecosystem-specific":[12],"package":[13,16,38,45,88],"repositories":[14,19],"and":[15,44,56,90,118,122],"managers.":[17],"Such":[18],"(e.g.,":[20],"npm,":[21],"PyPI)":[22],"serve":[23],"as":[24],"public":[25],"databases":[26],"that":[27,140],"users":[28],"can":[29,83],"query":[30],"to":[31,69,92,128,153],"retrieve":[32],"packages":[33],"for":[34,65],"various":[35],"functionalities,":[36],"whereas":[37],"managers":[39,89],"automatically":[40],"handle":[41],"dependency":[42],"resolution":[43],"installation":[46],"on":[47,72,97,108],"client":[49],"side.":[50],"These":[51],"mechanisms":[52],"enhance":[53],"software":[54,103],"modularization":[55],"accelerate":[57],"implementation.":[58],"However,":[59],"they":[60],"have":[61],"become":[62],"a":[63,73],"target":[64],"malicious":[66],"actors":[67],"seeking":[68],"propagate":[70],"malware":[71],"large":[74],"scale.":[75],"In":[76],"this":[77],"work,":[78],"we":[79,114,123,146],"show":[80],"how":[81,127],"attackers":[82,152],"leverage":[84],"capabilities":[85],"popular":[87],"achieve":[93],"arbitrary":[94],"code":[95],"execution":[96],"victim":[98],"machines,":[99],"thereby":[100],"realizing":[101],"open-source":[102],"supply":[104],"chain":[105],"attacks.":[106],"Based":[107],"analysis":[110],"7":[112],"ecosystems,":[113],"identify":[115],"3":[116],"install-time":[117],"4":[119],"runtime":[120],"techniques,":[121],"provide":[124,137],"recommendations":[125],"describing":[126],"reduce":[129],"risk":[131],"when":[132],"consuming":[133],"third-party":[134],"dependencies.":[135],"We":[136],"example":[138],"implementations":[139],"demonstrate":[141],"identified":[143],"techniques.":[144],"Furthermore,":[145],"describe":[147],"evasion":[148],"strategies":[149],"employed":[150],"by":[151],"circumvent":[154],"detection":[155],"mechanisms.":[156]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":6},{"year":2024,"cited_by_count":1},{"year":2023,"cited_by_count":2}],"updated_date":"2026-08-26T07:47:46.906454","created_date":"2025-10-10T00:00:00"}