mlsanityData to 7 Oct 2026

Taxonomy of Attacks on Open-Source Software Supply Chains

arXiv 2204.04008 ↗First posted 8 Apr 2022cs.CR cs.SEcited by 57

Not on the map. Why?

Cited by 27 in LLM agents and tool use, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today's open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims. This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards. User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.

Key facts. Cited by 57 papers in the map (data through 7 Oct 2026). First posted on arXiv 8 Apr 2022.

Builds on

No reference list yet.

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 2; 2024: 9; 2025: 10; 2026: 36.

57 papers.

Sort:

By area:

  1. 2026SoK: Agentic Skills -- Beyond Tool Use in LLM Agentscited by 120
  2. 2024We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMscited by 61
  3. 2026Prompt Injection Attacks on Agentic Coding Assistants: A Systematic Analysis of Vulnerabilities in Skills, Tools, and Protocol Ecosystemscited by 30
  4. 2025Automatic Red Teaming LLM-based Agents with Model Context Protocol Toolscited by 17
  5. 2026MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skillscited by 14
  6. 2026Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chaincited by 13
  7. 2024Just another copy and paste? Comparing the security vulnerabilities of ChatGPT generated code and StackOverflow answerscited by 12
  8. 2024A Large-Scale Exploit Instrumentation Study of AI/ML Supply Chain Attacks in Hugging Face Modelscited by 12
  9. 2023An Empirical Study on Using Large Language Models to Analyze Software Supply Chain Security Failurescited by 11
  10. 2026Towards Secure Agent Skills: Architecture, Threat Taxonomy, and Security Analysiscited by 11
  11. 2026Poise: Position-Aware One-Instruction Skill Injection for Silent Execution on LLM Agentscited by 7
  12. 2026Behavioral Integrity Verification for AI Agent Skillscited by 6
38 more
  1. 2024SoK: On the Offensive Potential of AIcited by 5
  2. 2025Fox in the Henhouse: Supply-Chain Backdoor Attacks Against Reinforcement Learningcited by 5
  3. 2026Agent Skill Security: Threat Models, Attacks, Defenses, and Evaluationcited by 4
  4. 2026You Told Me to Do It: Measuring Instructional Text-induced Private Data Leakage in LLM Agentscited by 3
  5. 2026Clawed and Dangerous: Can We Trust Open Agentic Systems?cited by 3
  6. 2026A Deterministic Control Plane for LLM Coding Agentscited by 3
  7. 2026Distributed Attacks in Persistent-State AI Controlcited by 3
  8. 2025Automatically Generating Rules of Malicious Software Packages via Large Language Modelcited by 2
  9. 2025On the (In)Security of Loading Machine Learning Modelscited by 2
  10. 2025Agentic AI for Autonomous Defense in Software Supply Chain Security: Beyond Provenance to Vulnerability Mitigationcited by 2
  11. 2026A Formal Security Framework for MCP-Based AI Agents: Threat Taxonomy, Verification Models, and Defense Mechanismscited by 2
  12. 2026SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agentscited by 2
  13. 2024SoK: A Systems Perspective on Compound AI Threats and Countermeasurescited by 1
  14. 2024Integrating Artificial Open Generative Artificial Intelligence into Software Supply Chain Securitycited by 1
  15. 2025LibVulnWatch: A Deep Assessment Agent System and Leaderboard for Uncovering Hidden Vulnerabilities in Open-Source AI Librariescited by 1
  16. 2025Investigating Security Implications of Automatically Generated Code on the Software Supply Chaincited by 1
  17. 2025Large Language Models Cannot Reliably Detect Vulnerabilities in JavaScript: The First Systematic Benchmark and Evaluationcited by 1
  18. 2025Exploring the Security Threats of Retriever Backdoors in Retrieval-Augmented Code Generationcited by 1
  19. 2026Cryptographic Registry Provenance: Structural Defense Against Dependency Confusion in AI Package Ecosystemscited by 1
  20. 2026Correct Code, Vulnerable Dependencies: A Large Scale Measurement Study of LLM-Specified Library Versionscited by 1
  21. 2026SEVRA-BENCH: Social Engineering of Vulnerabilities in Review Agentscited by 1
  22. 2026From Registry to Repository: How AI Agent Skills Are Written, Adapted, and Maintainedcited by 1
  23. 2026Setup Complete, Now You Are Compromised: Weaponizing Setup Instructions Against AI Coding Agentscited by 1
  24. 2023Code Ownership in Open-Source AI Software Securitycited by 0
  25. 2024Predicting Likely-Vulnerable Code Changes: Machine Learning-based Vulnerability Protections for Android Open Source Projectcited by 0
  26. 2024Unintentional Security Flaws in Code: Automated Defense via Root Cause Analysiscited by 0
  27. 2024Act in Collusion: Distributed Multi-Target Backdoor Attacks in Federated Learningcited by 0
  28. 2025Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?cited by 0
  29. 2026One RNG to Rule Them All: How Randomness Becomes an Attack Vector in Machine Learningcited by 0
  30. 2026Rewriting the Response Path: Silent Tampering and Provider-Signed Defense in BYOK LLM Agentscited by 0
  31. 2026DiffusionHijack: Supply-Chain PRNG Backdoor Attack on Diffusion Models and Quantum Random Number Defensecited by 0
  32. 2026The Impact of Configuring Agentic AI Coding Tools on Build-vs-Buy Decisions: A Study Protocolcited by 0
  33. 2026GitInject: Real-World Prompt Injection Attacks in AI-Powered CI/CD Pipelinescited by 0
  34. 2026Understanding and mitigating the risks of OpenClaw for non-technical users: A practical guide with Skillcited by 0
  35. 2026Lifecycle-Aware Dynamic Analysis for Secure ML Model Executioncited by 0
  36. 2026Poisoned Playbooks: Demystifying Knowledge Poisoning Effects on AI Security Agentscited by 0
  37. 2026Words Speak Louder Than Code: Investigating Cognitive Heuristics in LLM-Based Code Vulnerability Detectioncited by 0
  38. 2026LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detectioncited by 0

50 most cited of 57 All 57 (JSON)