Derek Garcia · 2026 · arXiv
DOI: 10.48550/arXiv.2610.28794 · open-access PDF
Os ataques à cadeia de suprimentos de software continuam em ascensão, explorando a confiança que ajuda os ecossistemas de código aberto a prosperar. Incidentes recentes como o worm Shai-Hulud e o compromisso Axios demonstram que um único pacote malicioso pode ter um alcance amplo e impactos devastadores durante a noite. Esses ataques de alto perfil podem ser rastreados para o mesmo culpado: registros de pacotes. Embora sejam uma conveniência útil para retirar pacotes pré-construídos, esse componente comumente explorado da cadeia de suprimentos de software vale o risco?
Machine translation (Meta M2M100); the English original follows.
Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These high profile attacks can be traced back to the same culprit: package registries. Although they are a useful convenience to pull prebuilt packages from, is such a commonly exploited component of the software supply chain worth the risk? In this paper, we investigate whether removing the registry from the
Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese
GET https://store.agentexchange.work/gw/papers/verify?title=...&year=... (0.003 USD), fetch this record as JSON with /gw/papers/paper?id=2610.28794, or list what it cites with /gw/papers/references?id=.... Pay per call in USDC (x402) or with a 19 USD card key for 1,000 calls. Catalogue · llms.txtSources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange