An empirical study of pre-trained model reuse in the hugging face deep learning model registry
Deep Neural Networks (DNNs) are being adopted as components in software systems.
Creating and specializing DNNs from scratch has grown increasingly difficult as state-of-the …
Creating and specializing DNNs from scratch has grown increasingly difficult as state-of-the …
Demystifying the vulnerability propagation and its evolution via dependency trees in the npm ecosystem
Third-party libraries with rich functionalities facilitate the fast development of JavaScript
software, leading to the explosive growth of the NPM ecosystem. However, it also brings …
software, leading to the explosive growth of the NPM ecosystem. However, it also brings …
Empirical analysis of security vulnerabilities in python packages
Software ecosystems play an important role in modern software development, providing an
open platform of reusable packages that speed up and facilitate development tasks …
open platform of reusable packages that speed up and facilitate development tasks …
Research directions in software supply chain security
Reusable software libraries, frameworks, and components, such as those provided by open-
source ecosystems and third-party suppliers, accelerate digital innovation. However, recent …
source ecosystems and third-party suppliers, accelerate digital innovation. However, recent …
Practical automated detection of malicious npm packages
The npm registry is one of the pillars of the JavaScript and Type-Script ecosystems, hosting
over 1.7 million packages ranging from simple utility libraries to complex frameworks and …
over 1.7 million packages ranging from simple utility libraries to complex frameworks and …
Sok: Analysis of software supply chain security by establishing secure design properties
This paper systematizes knowledge about secure software supply chain patterns. It identifies
four stages of a software supply chain attack and proposes three security properties crucial …
four stages of a software supply chain attack and proposes three security properties crucial …
Towards understanding third-party library dependency in c/c++ ecosystem
Third-party libraries (TPLs) are frequently reused in software to reduce development cost
and the time to market. However, external library dependencies may introduce …
and the time to market. However, external library dependencies may introduce …
Software supply chain: review of attacks, risk assessment strategies and security controls
The software product is a source of cyber-attacks that target organizations by using their
software supply chain as a distribution vector. As the reliance of software projects on open …
software supply chain as a distribution vector. As the reliance of software projects on open …
Maltracker: A fine-grained npm malware tracker copiloted by llm-enhanced dataset
As the largest package registry, Node Package Manager (NPM) has become the prime
target for various supply chain attacks recently and has been flooded with numerous …
target for various supply chain attacks recently and has been flooded with numerous …
On the outdatedness of workflows in the GitHub Actions ecosystem
GitHub Actions was introduced as a way to automate CI/CD workflows in GitHub, the largest
social coding platform. Thanks to its deep integration into GitHub, GitHub Actions can be …
social coding platform. Thanks to its deep integration into GitHub, GitHub Actions can be …