{"id":"https://openalex.org/W7167667411","doi":"https://doi.org/10.48550/arxiv.2607.05894","title":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","display_name":"Hidden Amplifiers: Cross-Level Risk in Software Supply Chains","publication_year":2026,"publication_date":"2026-07-07","ids":{"openalex":"https://openalex.org/W7167667411","doi":"https://doi.org/10.48550/arxiv.2607.05894"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2607.05894","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.05894","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2607.05894","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077390004","display_name":"Rakesh Podder","orcid":"https://orcid.org/0009-0008-7394-1369"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Podder, Rakesh","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5140231684","display_name":"Rafael Fabian Gonzalez Arellano","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Arellano, Rafael Fabian Gonzalez","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5102938076","display_name":"Indrajit Ray","orcid":"https://orcid.org/0000-0002-3612-7738"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ray, Indrajit","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.42989999055862427,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.42989999055862427,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12423","display_name":"Software Reliability and Analysis Research","score":0.15520000457763672,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10639","display_name":"Advanced Software Engineering Methodologies","score":0.14650000631809235,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5888000130653381},{"id":"https://openalex.org/keywords/code","display_name":"Code (set theory)","score":0.5501999855041504},{"id":"https://openalex.org/keywords/transitive-relation","display_name":"Transitive relation","score":0.489300012588501},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.4681999981403351},{"id":"https://openalex.org/keywords/position","display_name":"Position (finance)","score":0.44850000739097595},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.3889999985694885},{"id":"https://openalex.org/keywords/source-code","display_name":"Source code","score":0.3734999895095825},{"id":"https://openalex.org/keywords/software-quality","display_name":"Software quality","score":0.3513999879360199}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7049000263214111},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5888000130653381},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.5501999855041504},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.5060999989509583},{"id":"https://openalex.org/C191399111","wikidata":"https://www.wikidata.org/wiki/Q64861","display_name":"Transitive relation","level":2,"score":0.489300012588501},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.4681999981403351},{"id":"https://openalex.org/C198082294","wikidata":"https://www.wikidata.org/wiki/Q3399648","display_name":"Position (finance)","level":2,"score":0.44850000739097595},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.3889999985694885},{"id":"https://openalex.org/C43126263","wikidata":"https://www.wikidata.org/wiki/Q128751","display_name":"Source code","level":2,"score":0.3734999895095825},{"id":"https://openalex.org/C117447612","wikidata":"https://www.wikidata.org/wiki/Q1412670","display_name":"Software quality","level":4,"score":0.3513999879360199},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.34869998693466187},{"id":"https://openalex.org/C108713360","wikidata":"https://www.wikidata.org/wiki/Q1824206","display_name":"Supply chain","level":2,"score":0.34459999203681946},{"id":"https://openalex.org/C12174686","wikidata":"https://www.wikidata.org/wiki/Q1058438","display_name":"Risk assessment","level":2,"score":0.33550000190734863},{"id":"https://openalex.org/C149091818","wikidata":"https://www.wikidata.org/wiki/Q2429814","display_name":"Software system","level":3,"score":0.3163999915122986},{"id":"https://openalex.org/C2776299755","wikidata":"https://www.wikidata.org/wiki/Q432449","display_name":"Carry (investment)","level":2,"score":0.31139999628067017},{"id":"https://openalex.org/C32896092","wikidata":"https://www.wikidata.org/wiki/Q189447","display_name":"Risk management","level":2,"score":0.305400013923645},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.2996000051498413},{"id":"https://openalex.org/C78780964","wikidata":"https://www.wikidata.org/wiki/Q7233193","display_name":"Position paper","level":2,"score":0.2888999879360199},{"id":"https://openalex.org/C2986432223","wikidata":"https://www.wikidata.org/wiki/Q5449740","display_name":"Risk model","level":2,"score":0.27959999442100525},{"id":"https://openalex.org/C200601418","wikidata":"https://www.wikidata.org/wiki/Q2193887","display_name":"Reliability engineering","level":1,"score":0.2782000005245209},{"id":"https://openalex.org/C97686452","wikidata":"https://www.wikidata.org/wiki/Q7604153","display_name":"Static analysis","level":2,"score":0.2500999867916107}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2607.05894","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.05894","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2607.05894","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2607.05894","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Life in Land","score":0.5404381155967712,"id":"https://metadata.un.org/sdg/15"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"software":[1],"supply":[2],"chains":[3],"comprise":[4],"hundreds":[5],"of":[6,82],"transitive":[7],"dependencies,":[8],"yet":[9],"existing":[10],"analysis":[11,26,140],"tools":[12],"operate":[13],"at":[14],"either":[15],"the":[16,22],"ecosystem":[17,132],"level":[18,24],"(dependency":[19],"graphs)":[20],"or":[21],"code":[23,119,129],"(static":[25],"within":[27],"packages).":[28],"This":[29],"separation":[30],"creates":[31],"two":[32],"failure":[33],"modes.":[34],"First,":[35],"false-positive":[36],"CVE":[37],"alerts":[38],"for":[39,45,120,146],"unreachable":[40],"code.":[41],"Second,":[42],"blind":[43],"spots":[44],"structurally":[46],"critical":[47],"micro-dependencies.":[48],"We":[49],"introduce":[50],"cross-level":[51,112,139],"risk":[52,59,68,101],"propagation,":[53],"a":[54,66,80,142],"framework":[55],"that":[56,97,138],"bridges":[57],"code-level":[58],"metrics":[60],"with":[61,87],"ecosystem-level":[62],"dependency":[63],"exposure":[64],"through":[65],"unified":[67],"formula.":[69],"Preliminary":[70],"evaluation":[71],"on":[72],"50":[73,90],"packages":[74,115],"across":[75],"npm":[76],"and":[77,131],"PyPI":[78],"reveals":[79],"class":[81],"hidden":[83],"amplifiers":[84],"--":[85,96],"micro-dependencies":[86],"fewer":[88],"than":[89],"methods":[91],"but":[92],"over":[93],"50,000":[94],"dependents":[95],"carry":[98],"outsized":[99],"supply-chain":[100,147],"invisible":[102],"to":[103],"all":[104],"current":[105,124],"Software":[106],"Composition":[107],"Analysis":[108],"(SCA)":[109],"tools.":[110],"Without":[111],"analysis,":[113],"such":[114],"can":[116],"harbor":[117],"exploitable":[118],"years":[121],"because":[122],"no":[123],"tool":[125],"considers":[126],"both":[127],"internal":[128],"structure":[130],"position":[133],"simultaneously.":[134],"These":[135],"results":[136],"suggest":[137],"opens":[141],"new":[143],"design":[144],"space":[145],"security.":[148]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-07-09T00:00:00"}