下一篇：Backstabber's Knife Collection：开源软件供应链攻击回顾
Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks
摘要：
软件供应链攻击的特征在于将恶意代码注入到软件包中，以危害链下游的相关系统。近年来，许多供应链攻击利用了软件开发过程中越来越多地使用开源，这是由依赖管理器提供的，依赖管理器在整个软件生存周期中自动解析、下载和安装数百个开源软件包。本文介绍了一个包含174个恶意软件包的数据集，这些软件包被用于对开源软件供应链的实际攻击，并通过流行的软件包存储库npm，PyPI和RubyGems分发。这些数据包的日期从2015年11月到2019年11月，是手动收集和分析的。本文还提出了两个一般的攻击树，提供一个结构化的概述技术注入恶意代码到下游用户的依赖树，并在不同的时间和不同的条件下执行这样的代码。这项工作旨在促进开源和研究社区未来开发预防和检测保障措施。
英文摘要：
A software supply chain attack is characterized by the injection of malicious code into a software package in order to compromise dependent systems further down the chain. Recent years saw a number of supply chain attacks that leverage the increasing use of open source during software development, which is facilitated by dependency managers that automatically resolve, download and install hundreds of open source packages throughout the software life cycle. This paper presents a dataset of 174 malicious software packages that were used in real-world attacks on open source software supply chains, and which were distributed via the popular package repositories npm, PyPI, and RubyGems. Those packages, dating from November 2015 to November 2019, were manually collected and analyzed. The paper also presents two general attack trees to provide a structured overview about techniques to inject malicious code into the dependency tree of downstream users, and to execute such code at different times and under different conditions. This work is meant to facilitate the future development of preventive and detective safeguards by open source and research communities.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
