HackerPapers

arXiv:2005.09535cs.CR

Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

Marc Ohm, Henrik Plate, Arnold Sykosch, Michael Meier

Abstract

A software supply chain attack is characterized by the injection of malicious code into a software package in order to compromise dependent systems further down the chain. Recent years saw a number of supply chain attacks that leverage the increasing use of open source during software development, which is facilitated by dependency managers that automatically resolve, download and install hundreds of open source packages throughout the software life cycle. This paper presents a dataset of 174 malicious software packages that were used in real-world attacks on open source software supply chains, and which were distributed via the popular package repositories npm, PyPI, and RubyGems. Those packages, dating from November 2015 to November 2019, were manually collected and analyzed. The paper also presents two general attack trees to provide a structured overview about techniques to inject malicious code into the dependency tree of downstream users, and to execute such code at different times and under different conditions. This work is meant to facilitate the future development of preventive and detective safeguards by open source and research communities.

arXiv comments
This is a pre-print version of the paper that appears in the proceedings of The 17th Conference on Detection of Intrusions and Malware & Vulnerability Assessment (DIMVA)
Journal reference
DOI
Subjects
cs.CRCryptography and Security cs.SESoftware Engineering

On Hacker News

Linked by 3 identifiable commenters in 3 comments across 3 threads, from May 2020 to Sep 2025. Found in 1 HN submission from May 2020 to May 2020. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments3 threads

  1. DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware 1 comment

    • Disclosure: I’m the founder of https://socket.dev A week waiting period would not be enough. On average, npm malware lingers on the registry for 209 days before it's finally reported and removed. Source: https://arxiv.org/abs/2005.09535

      ferossView on HNParent context

  2. Making Librem 5 Apps [video] 1 comment

    • > much less malware, if at all Backstabber's Knife Collection: A Review of Open Source Supply Chain Attacks - https://arxiv.org/abs/2005.09535 F-Droid's a great project, but needs to take security more seriously, even if that means accepting some help from adjacent projects.

      atat7024View on HNParent context

  3. The FBI tracking your browsing history without a warrant might be the beginning 1 comment

    • > I use only free software, built from source, to be sure there's no tracker in it https://arxiv.org/abs/2005.09535 How do you plan to mitigate ^^ ?

      maerF0x0View on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.