Derek Garcia · 2026 · arXiv
DOI: 10.48550/arXiv.2610.28794 · open-access PDF
Serangan rantai pasokan perangkat lunak terus meningkat, mengeksploitasi kepercayaan yang membantu ekosistem sumber terbuka berkembang. Insiden baru-baru ini seperti cacing Shai-Hulud dan kompromi Axios menunjukkan bahwa satu paket berbahaya dapat memiliki jangkauan yang luas dan dampak yang menghancurkan sepanjang malam. Serangan profil tinggi ini dapat ditelusuri kembali ke penjahat yang sama: registri paket. Meskipun mereka merupakan kenyamanan yang berguna untuk menarik paket prefabrikasi dari, apakah komponen rantai pasokan perangkat lunak yang biasa dimanfaatkan layak mengambil risiko?
Machine translation (Meta M2M100); the English original follows.
Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These high profile attacks can be traced back to the same culprit: package registries. Although they are a useful convenience to pull prebuilt packages from, is such a commonly exploited component of the software supply chain worth the risk? In this paper, we investigate whether removing the registry from the
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.28794, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange