mlsanityData to 7 Oct 2026

Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

arXiv 2005.09535 ↗First posted 19 May 2020cs.CR cs.SEcited by 57

Not on the map. Why?

Cited by 31 in LLM agents and tool use, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

A software supply chain attack is characterized by the injection of malicious code into a software package in order to compromise dependent systems further down the chain. Recent years saw a number of supply chain attacks that leverage the increasing use of open source during software development, which is facilitated by dependency managers that automatically resolve, download and install hundreds of open source packages throughout the software life cycle. This paper presents a dataset of 174 malicious software packages that were used in real-world attacks on open source software supply chains, and which were distributed via the popular package repositories npm, PyPI, and RubyGems. Those packages, dating from November 2015 to November 2019, were manually collected and analyzed. The paper also presents two general attack trees to provide a structured overview about techniques to inject malicious code into the dependency tree of downstream users, and to execute such code at different times and under different conditions. This work is meant to facilitate the future development of preventive and detective safeguards by open source and research communities.

Key facts. Cited by 57 papers in the map (data through 7 Oct 2026). First posted on arXiv 19 May 2020.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2021: 1; 2022: 1; 2023: 1; 2024: 3; 2025: 9; 2026: 42.

57 papers.

Sort:

By area:

  1. 2021Evaluating Large Language Models Trained on Codecited by 8,053
  2. 2026Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scalecited by 94
  3. 2024We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMscited by 61
  4. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 30
  5. 2026Formal Analysis and Supply Chain Security for Agentic AI Skillscited by 21
  6. 2026SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skillscited by 18
  7. 2026Auditable Agentscited by 14
  8. 2026MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skillscited by 14
  9. 2026Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chaincited by 13
  10. 2024Just another copy and paste? Comparing the security vulnerabilities of ChatGPT generated code and StackOverflow answerscited by 12
  11. 2023An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failurescited by 11
  12. 2026Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysiscited by 11
38 more
  1. 2026Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidancecited by 8
  2. 2026Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agentscited by 7
  3. 2024Leveraging Large Language Models to Detect npm Malicious Packagescited by 6
  4. 2026Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malwarecited by 6
  5. 2025Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learningcited by 5
  6. 2025ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generationcited by 5
  7. 2026Exploiting LLM Agent Supply Chains via Payload-less Skillscited by 5
  8. 2022Malicious Source Code Detection Using Transformercited by 4
  9. 2026Latent Reuse in Agent Skills: Multi-modal Clone Detection at Ecosystem Scalecited by 4
  10. 2026Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skillscited by 4
  11. 2026ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagreecited by 4
  12. 2026Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluationcited by 4
  13. 2025Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?cited by 3
  14. 2025PickleBall: Secure Deserialization of Pickle-based Machine Learning Models (Extended Report)cited by 3
  15. 2026You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agentscited by 3
  16. 2026Clawed and Dangerous: Can We Trust Open Agentic Systems?cited by 3
  17. 2026A Deterministic Control Plane for LLM Coding Agentscited by 3
  18. 2025Automatically Generating Rules of Malicious Software Packages via Large Language Modelcited by 2
  19. 2025On the (In)Security of Loading Machine Learning Modelscited by 2
  20. 2025FuncPoison: Poisoning Function Library to Hijack Multi-agent Autonomous Driving Systemscited by 2
  21. 2026SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agentscited by 2
  22. 2025LibVulnWatch: A Deep Assessment Agent System and Leaderboard for Uncovering Hidden Vulnerabilities in Open-Source AI Librariescited by 1
  23. 2026Many Hands Make Light Work: An LLM-based Multi-Agent System for Detecting Malicious PyPI Packagescited by 1
  24. 2026SafePickle: Robust and Generic ML Detection of Malicious Pickle-based ML Modelscited by 1
  25. 2026AgentWard: A Lifecycle Security Architecture for Autonomous AI Agentscited by 1
  26. 2026Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystemscited by 1
  27. 2026SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agentscited by 1
  28. 2026From Registry to Repository: How AI Agent Skills Are Written, Adapted, and Maintainedcited by 1
  29. 2026Cyber-Financial Contagion: Modeling the Propagation of an AI Vendor Compromise Through the Banking Systemcited by 1
  30. 2025Leveraging Code Cohesion Analysis to Identify Source Code Supply Chain Attackscited by 0
  31. 2026CHASE: LLM Agents for Dissecting Malicious PyPI Packagescited by 0
  32. 2026Secure On-Premise Deployment of Open-Weights Large Language Models in Radiology: An Isolation-First Architecture with Prospective Pilot Evaluationcited by 0
  33. 2026eDySec: A Deep Learning-based Explainable Dynamic Analysis Framework for Detecting Malicious Packages in PyPI Ecosystemcited by 0
  34. 2026Security Document Classification with a Fine-Tuned Local Large Language Model: Benchmark Data and an Open-Source Systemcited by 0
  35. 2026Lifecycle-Aware Dynamic Analysis for Secure ML Model Executioncited by 0
  36. 2026Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agentscited by 0
  37. 2026Fortress and Gatekeeper: Theorizing Transitive Trust in Third-Party Cybersecurity Risk Governancecited by 0
  38. 2026LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detectioncited by 0

50 most cited of 57 All 57 (JSON)