# ARMS: A Vision for Actor Reputation Metric Systems in the Open-Source Software Supply Chain

arXiv: https://arxiv.org/abs/2505.18760 · HTML: https://mlsanity.com/paper/2505.18760/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 24 May 2025.

## Built on by (most cited first, 1 of 1)

- [An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chains](https://mlsanity.com/paper/2511.13341/) (2025)

## Abstract (arXiv)

Many critical information technology and cyber-physical systems rely on a supply chain of open-source software projects. OSS project maintainers often integrate contributions from external actors. While maintainers can assess the correctness of a pull request, assessing a pull request's cybersecurity implications is challenging. To help maintainers make this decision, we propose that the open-source ecosystem should incorporate Actor Reputation Metrics (ARMS). This capability would enable OSS maintainers to assess a prospective contributor's cybersecurity reputation. To support the future instantiation of ARMS, we identify seven generic security signals from industry standards; map concrete metrics from prior work and available security tools, describe study designs to refine and assess the utility of ARMS, and finally weigh its pros and cons.