Backstabber's Knife Collection

Ohm, M., Plate, H., Sykosch, A., & Meier, M. (2020). Backstabber's Knife Collection: A Review of Open Source Software Supply Chain Attacks. Proceedings of DIMVA.

Type

Book chapter

Intellectual base

Review or monograph

Year

2020

DOI

10.1007/978-3-030-52683-2_2

ISBN

9783030526825

Link

https://doi.org/10.1007/978-3-030-52683-2_2

Cited from

cognitive_science, systems_cybernetics

Cited by

2 citations across 2 artifacts.

Each citation links to the sentence it supports in the citing article.

Primes

• Associative Property Transfer
  • It also appears in brand and marketing (value flowing across endorsement links, scandal contagion to parent brands), in software dependency reasoning (blame assigned by call-graph proximity, risk re-assessed for dependents of a compromised dependency)

    This sourceAnalyzes how a compromise in one dependency propagates risk to every downstream dependent along the dependency/call graph — the software-supply-chain instance of property-flow along an associative link.

• Record-Reality Divergence
  • Warehouse and retail inventory (phantom inventory) — stock records diverge from physical counts through shrinkage and mis-scans; replenishment algorithms under- or over-order based on the divergence direction. Software supply chain — lockfiles point at registry artefacts that have been yanked, replaced, or namespace-attacked; build systems install the wrong code.

    This sourceDocuments lockfile/registry artefacts being yanked, replaced, or namespace-attacked so build systems install the wrong code — a record (lockfile) diverging from the registry reality it references.

Verification

This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.

Registry ID ref:ffc0a11e4bdc · see in the full table