# Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks

arXiv: https://arxiv.org/abs/2005.09535 · HTML: https://mlsanity.com/paper/2005.09535/

## Key facts

- Cited by 61 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 19 May 2020.

## Built on by (most cited first, 30 of 61)

- [Evaluating Large Language Models Trained on Code](https://mlsanity.com/paper/2107.03374/) (2021)
- [Agent Skills in the Wild: An Empirical Study of Security Vulnerabilities at Scale](https://mlsanity.com/paper/2601.10338/) (2026)
- [We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs](https://mlsanity.com/paper/2406.10279/) (2024)
- [Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystems](https://mlsanity.com/paper/2601.17548/) (2026)
- [Formal Analysis and Supply Chain Security for Agentic AI Skills](https://mlsanity.com/paper/2603.00195/) (2026)
- [SkillSieve: A Hierarchical Triage Framework for Detecting Malicious AI Agent Skills](https://mlsanity.com/paper/2604.06550/) (2026)
- [MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills](https://mlsanity.com/paper/2606.07131/) (2026)
- [Auditable Agents](https://mlsanity.com/paper/2604.05485/) (2026)
- [Just another copy and paste? Comparing the security vulnerabilities of ChatGPT generated code and StackOverflow answers](https://mlsanity.com/paper/2403.15600/) (2024)
- [Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysis](https://mlsanity.com/paper/2604.02837/) (2026)
- [Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain](https://mlsanity.com/paper/2604.08407/) (2026)
- [An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failures](https://mlsanity.com/paper/2308.04898/) (2023)
- [Cloak and Detonate: Scanner Evasion and Dynamic Detection of Agent Skill Malware](https://mlsanity.com/paper/2607.02357/) (2026)
- [Trojan's Whisper: Stealthy Manipulation of OpenClaw through Injected Bootstrapped Guidance](https://mlsanity.com/paper/2603.19974/) (2026)
- [Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agents](https://mlsanity.com/paper/2606.07943/) (2026)
- [Leveraging Large Language Models to Detect npm Malicious Packages](https://mlsanity.com/paper/2403.12196/) (2024)
- [Exploiting LLM Agent Supply Chains via Payload-less Skills](https://mlsanity.com/paper/2605.14460/) (2026)
- [ClawHub Security Signals: When VirusTotal, Static Analysis, and SkillSpector Disagree](https://mlsanity.com/paper/2606.01494/) (2026)
- [Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learning](https://mlsanity.com/paper/2505.19532/) (2025)
- [ImportSnare: Directed "Code Manual" Hijacking in Retrieval-Augmented Code Generation](https://mlsanity.com/paper/2509.07941/) (2025)
- [Trust Me, Import This: Dependency Steering Attacks via Malicious Agent Skills](https://mlsanity.com/paper/2605.09594/) (2026)
- [Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluation](https://mlsanity.com/paper/2607.13987/) (2026)
- [Malicious Source Code Detection Using Transformer](https://mlsanity.com/paper/2209.07957/) (2022)
- [Latent Reuse in Agent Skills: Multi-modal Clone Detection at Ecosystem Scale](https://mlsanity.com/paper/2603.22447/) (2026)
- [Detecting Malicious Source Code in PyPI Packages with LLMs: Does RAG Come in Handy?](https://mlsanity.com/paper/2504.13769/) (2025)
- [PickleBall: Secure Deserialization of Pickle-based Machine Learning Models (Extended Report)](https://mlsanity.com/paper/2508.15987/) (2025)
- [You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agents](https://mlsanity.com/paper/2603.11862/) (2026)
- [Clawed and Dangerous: Can We Trust Open Agentic Systems?](https://mlsanity.com/paper/2603.26221/) (2026)
- [A Deterministic Control Plane for LLM Coding Agents](https://mlsanity.com/paper/2606.26924/) (2026)
- [SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents](https://mlsanity.com/paper/2607.25619/) (2026)

## Abstract (arXiv)

A software supply chain attack is characterized by the injection of malicious code into a software package in order to compromise dependent systems further down the chain. Recent years saw a number of supply chain attacks that leverage the increasing use of open source during software development, which is facilitated by dependency managers that automatically resolve, download and install hundreds of open source packages throughout the software life cycle. This paper presents a dataset of 174 malicious software packages that were used in real-world attacks on open source software supply chains, and which were distributed via the popular package repositories npm, PyPI, and RubyGems. Those packages, dating from November 2015 to November 2019, were manually collected and analyzed. The paper also presents two general attack trees to provide a structured overview about techniques to inject malicious code into the dependency tree of downstream users, and to execute such code at different times and under different conditions. This work is meant to facilitate the future development of preventive and detective safeguards by open source and research communities.