Newest papers

Sign Here: Attributing a Source for a More Trustworthy Software Supply Chain

Derek Garcia · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.28794 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

软件供应链攻击继续上升,利用了帮助开源生态系统繁荣的信任。最近的预测事件,如Shai-Hulud蠕虫和Axios妥协,表明单个恶意包可以在一夜之间产生广泛的和破坏性的影响。这些高档攻击可以追溯到同一个罪魁祸首:包注册表上。尽管它们是从前构建的整个表面攻击的有用便利性,但软件供应链的这种常被剥削的组成部分是否值得风险? 在本文中,我们调查是否通过直接从源头构建包从开发人员工作流程中删除注册表可以作为恶意软件预防策略 - 有效地删除整个表面攻击。我们的假设是,恶意包避免将源分配到最低限度的可见性水平?在这个论文中

Machine translation (Meta M2M100); the English original follows.

Abstract

Software supply chain attacks continue to be on the rise, exploiting the trust that helps open source ecosystems thrive. Recent incidents like the Shai-Hulud worm and the Axios compromise demonstrate that a single malicious package can have wide reaching and devastating impacts overnight. These high profile attacks can be traced back to the same culprit: package registries. Although they are a useful convenience to pull prebuilt packages from, is such a commonly exploited component of the software supply chain worth the risk? In this paper, we investigate whether removing the registry from the developer workflow by building packages directly from source can serve as a malware prevention strategy - effectively removing an entire attack surface. Our hypothesis is that malicious packages avoid attributing a source to minimize visibility, while benign packages seek exposure and therefore link to their repositories. We evaluate this through three research questions: how effective is building from source at avoiding malware, how feasible is it to build from source in the current state of the supply chain, and how the building from source strategy compares to state-of-the-art security scanners. To do so, we (1) construct an aggregate dataset of 47,066 malicious packages from four academic and one industry malicious datasets source across npm and PyPI ecosystems, (2) build a snapshot index of all 3.9 million npm and 764 thousand PyPI packages, and (3) analyze all malicious samples alongside a statistically significant sample of 16,569 packages from each registry, totaling 33,138 packages. We find that simply checking for a source has a success rate between 87.7 and 99.9 percent of preventing malware, depending on the level of source vetting. Consequently, there is a significant lack of transparency within benign packages, with only 47.4 percent attributing a source an end user could build from.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Computer security, Supply chain, Malware, Software, Workflow

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange