{"id":"https://openalex.org/W7171728016","doi":"https://doi.org/10.1145/3733827.3765523","title":"Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order","display_name":"Maven-Hijack: Software Supply Chain Attack Exploiting Packaging Order","publication_year":2025,"publication_date":"2025-10-13","ids":{"openalex":"https://openalex.org/W7171728016","doi":"https://doi.org/10.1145/3733827.3765523"},"language":null,"primary_location":{"id":"doi:10.1145/3733827.3765523","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733827.3765523","pdf_url":null,"source":null,"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3733827.3765523","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136519913","display_name":"Frank Reyes Garcia","orcid":"https://orcid.org/0000-0003-0028-5010"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Frank Reyes","raw_affiliation_strings":["KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0003-0028-5010","affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5107155016","display_name":"Federico Bono","orcid":null},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Federico Bono","raw_affiliation_strings":["KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0009-0008-3662-8904","affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100459476","display_name":"Aman Sharma","orcid":"https://orcid.org/0000-0003-2263-7902"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Aman Sharma","raw_affiliation_strings":["KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0003-2263-7902","affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086536054","display_name":"Beno\u00eet Baudry","orcid":"https://orcid.org/0000-0002-4015-4640"},"institutions":[{"id":"https://openalex.org/I70931966","display_name":"Universit\u00e9 de Montr\u00e9al","ror":"https://ror.org/0161xgx34","country_code":"CA","type":"education","lineage":["https://openalex.org/I70931966"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Benoit Baudry","raw_affiliation_strings":["Universit\u00e9 de Montr\u00e9al, Montr\u00e9al, Canada"],"raw_orcid":"https://orcid.org/0000-0002-4015-4640","affiliations":[{"raw_affiliation_string":"Universit\u00e9 de Montr\u00e9al, Montr\u00e9al, Canada","institution_ids":["https://openalex.org/I70931966"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5027206285","display_name":"Martin Monperrus","orcid":"https://orcid.org/0000-0003-3505-3383"},"institutions":[{"id":"https://openalex.org/I86987016","display_name":"KTH Royal Institute of Technology","ror":"https://ror.org/026vcq606","country_code":"SE","type":"education","lineage":["https://openalex.org/I86987016"]}],"countries":["SE"],"is_corresponding":false,"raw_author_name":"Martin Monperrus","raw_affiliation_strings":["KTH Royal Institute of Technology, Stockholm, Sweden"],"raw_orcid":"https://orcid.org/0000-0003-3505-3383","affiliations":[{"raw_affiliation_string":"KTH Royal Institute of Technology, Stockholm, Sweden","institution_ids":["https://openalex.org/I86987016"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"7"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":null,"topics":[],"keywords":[{"id":"https://openalex.org/keywords/java","display_name":"Java","score":0.7516999840736389},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.6653000116348267},{"id":"https://openalex.org/keywords/tracing","display_name":"Tracing","score":0.6033999919891357},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.5327000021934509},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.5103999972343445},{"id":"https://openalex.org/keywords/plug-in","display_name":"Plug-in","score":0.5},{"id":"https://openalex.org/keywords/real-time-java","display_name":"Real time Java","score":0.4787999987602234},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.4738999903202057},{"id":"https://openalex.org/keywords/codebase","display_name":"Codebase","score":0.4677000045776367}],"concepts":[{"id":"https://openalex.org/C548217200","wikidata":"https://www.wikidata.org/wiki/Q251","display_name":"Java","level":2,"score":0.7516999840736389},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7373999953269958},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.6653000116348267},{"id":"https://openalex.org/C138673069","wikidata":"https://www.wikidata.org/wiki/Q322229","display_name":"Tracing","level":2,"score":0.6033999919891357},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.5327000021934509},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.5103999972343445},{"id":"https://openalex.org/C4924752","wikidata":"https://www.wikidata.org/wiki/Q184148","display_name":"Plug-in","level":2,"score":0.5},{"id":"https://openalex.org/C132106392","wikidata":"https://www.wikidata.org/wiki/Q1373903","display_name":"Real time Java","level":3,"score":0.4787999987602234},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.4738999903202057},{"id":"https://openalex.org/C51929080","wikidata":"https://www.wikidata.org/wiki/Q2425187","display_name":"Codebase","level":3,"score":0.4677000045776367},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4424000084400177},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.4156000018119812},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.40689998865127563},{"id":"https://openalex.org/C174839445","wikidata":"https://www.wikidata.org/wiki/Q1134386","display_name":"Lock (firearm)","level":2,"score":0.38269999623298645},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.3650999963283539},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.34060001373291016},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.31310001015663147},{"id":"https://openalex.org/C145428669","wikidata":"https://www.wikidata.org/wiki/Q471748","display_name":"Exception handling","level":2,"score":0.29660001397132874},{"id":"https://openalex.org/C105446022","wikidata":"https://www.wikidata.org/wiki/Q445962","display_name":"Legacy system","level":3,"score":0.2955000102519989},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.295199990272522},{"id":"https://openalex.org/C174954855","wikidata":"https://www.wikidata.org/wiki/Q7623626","display_name":"strictfp","level":4,"score":0.29440000653266907},{"id":"https://openalex.org/C182306322","wikidata":"https://www.wikidata.org/wiki/Q1779371","display_name":"Order (exchange)","level":2,"score":0.2705000042915344},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.26339998841285706},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.259799987077713},{"id":"https://openalex.org/C2781251061","wikidata":"https://www.wikidata.org/wiki/Q5416089","display_name":"Evasion (ethics)","level":3,"score":0.2581999897956848},{"id":"https://openalex.org/C181907185","wikidata":"https://www.wikidata.org/wiki/Q1100098","display_name":"Java concurrency","level":4,"score":0.2524999976158142}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3733827.3765523","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733827.3765523","pdf_url":null,"source":null,"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3733827.3765523","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3733827.3765523","pdf_url":null,"source":null,"license":"cc-by-nc-sa","license_id":"https://openalex.org/licenses/cc-by-nc-sa","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":15,"referenced_works":["https://openalex.org/W2148542607","https://openalex.org/W2794456160","https://openalex.org/W2899324080","https://openalex.org/W2953482240","https://openalex.org/W2953934237","https://openalex.org/W3013276240","https://openalex.org/W3046453918","https://openalex.org/W3127006109","https://openalex.org/W4221144146","https://openalex.org/W4289939589","https://openalex.org/W4313563627","https://openalex.org/W4378465430","https://openalex.org/W4392340994","https://openalex.org/W4402897345","https://openalex.org/W6966459214"],"related_works":[],"abstract_inverted_index":{"Java":[0,54,136,148,170],"projects":[1],"frequently":[2],"rely":[3],"on":[4],"package":[5],"managers":[6],"such":[7,132],"as":[8,72,133],"Maven":[9,47,140,154],"to":[10,27,188],"manage":[11],"complex":[12],"webs":[13],"of":[14,104],"external":[15],"dependencies.":[16],"While":[17],"these":[18],"tools":[19],"streamline":[20],"development,":[21],"they":[22],"also":[23],"introduce":[24],"subtle":[25],"risks":[26],"the":[28,43,51,53,67,93,101,109,139,153,162,175],"software":[29],"supply":[30,191],"chain.":[31],"In":[32],"this":[33,105],"paper,":[34],"we":[35],"present":[36],"Maven-Hijack,":[37],"a":[38,63,73,77,111],"novel":[39],"attack":[40,106],"that":[41,79],"exploits":[42],"order":[44],"in":[45,181],"which":[46],"packages":[48],"dependencies":[49],"and":[50,119,138,165,184],"way":[52],"Virtual":[55],"Machine":[56],"resolves":[57],"classes":[58],"at":[59],"runtime.":[60],"By":[61],"injecting":[62],"malicious":[64],"class":[65,159],"with":[66,157],"same":[68],"fully":[69],"qualified":[70],"name":[71],"legitimate":[74],"one":[75],"into":[76],"dependency":[78,185],"is":[80],"packaged":[81],"earlier,":[82],"an":[83],"attacker":[84],"can":[85],"silently":[86],"override":[87],"core":[88],"application":[89],"behavior":[90],"without":[91],"modifying":[92],"main":[94],"codebase":[95],"or":[96],"library":[97],"names.":[98],"We":[99,127],"demonstrate":[100],"real-world":[102],"feasibility":[103],"by":[107],"compromising":[108],"Corona-Warn-App,":[110],"widely":[112],"used":[113],"open-source":[114],"COVID-19":[115],"contact":[116],"tracing":[117],"system,":[118],"gaining":[120],"control":[121],"over":[122],"its":[123],"database":[124],"connection":[125],"logic.":[126],"evaluate":[128],"three":[129],"mitigation":[130],"strategies,":[131],"sealed":[134],"JARs,":[135],"Modules,":[137],"Enforcer":[141,155],"plugin.":[142],"Our":[143],"results":[144],"show":[145],"that,":[146],"while":[147],"Modules":[149],"offer":[150],"strong":[151],"protection,":[152],"plugin":[156],"duplicate":[158],"detection":[160],"provides":[161],"most":[163],"practical":[164],"effective":[166],"defense":[167],"for":[168,178],"current":[169],"projects.":[171],"These":[172],"findings":[173],"highlight":[174],"urgent":[176],"need":[177],"improved":[179],"safeguards":[180],"Java\u2019s":[182],"build":[183],"management":[186],"processes":[187],"prevent":[189],"stealthy":[190],"chain":[192],"attacks.":[193]},"counts_by_year":[],"updated_date":"2026-07-30T17:31:21.811387","created_date":"2026-07-30T00:00:00"}