Source-linked AI summary
Taxonomy of Attacks on Open-Source Software Supply Chains
Piergiorgio Ladisa, Henrik Plate, Matias Martinez, Olivier Barais
TL;DR
The widespread use of open-source software and trust relationships across its supply chain create opportunities for attackers to inject malicious code into components used by downstream users. This work develops and surveys a language- and ecosystem-independent attack-tree taxonomy of OSS supply-chain attacks, identifying 107 attack vectors and associated safeguards. Domain experts and developers positively assessed the taxonomy, while survey responses also characterized safeguard utility, costs, awareness, and use.
Problem
Widespread open-source use and trust relationships among OSS stakeholders expose software supply chains to attacks that inject malicious code into components used by downstream users.
Method
The study reviews scientific and grey literature, builds an attack-tree taxonomy of 107 OSS supply-chain attack vectors, maps safeguards to attacks, and conducts expert and developer surveys.
Results
Domain experts and developers positively assessed the taxonomy's comprehensiveness, comprehensibility, usefulness, and suitability for different use-cases.
Takeaways & Limitations
The taxonomy and safeguard mappings provide a common reference for research, help determine stakeholder exposure, and can support security-budget decisions based on safeguard utility and cost.
Takeaways & Limitations
The taxonomy reflects the current state of the art and is expected to require evolution as OSS supply-chain technologies change.
Abstract
from arXiv · showhide
The widespread dependency on open-source software makes it a fruitful target for malicious actors, as demonstrated by recurring attacks. The complexity of today's open-source supply chains results in a significant attack surface, giving attackers numerous opportunities to reach the goal of injecting malicious code into open-source artifacts that is then downloaded and executed by victims. This work proposes a general taxonomy for attacks on open-source supply chains, independent of specific programming languages or ecosystems, and covering all supply chain stages from code contributions to package distribution. Taking the form of an attack tree, it covers 107 unique vectors, linked to 94 real-world incidents, and mapped to 33 mitigating safeguards. User surveys conducted with 17 domain experts and 134 software developers positively validated the correctness, comprehensiveness and comprehensibility of the taxonomy, as well as its suitability for various use-cases. Survey participants also assessed the utility and costs of the identified safeguards, and whether they are used.
I. INTRODUCTION
Open-source supply chains are attractive targets because widespread, distributed dependencies create many opportunities to inject malicious code. The paper addresses the lack of a comprehensive, comprehensible, ecosystem-independent account by proposing and validating a taxonomy with associated safeguards.
- Motivation: Open-source supply chain attacks inject malicious code into components to compromise downstream users, with incidents demonstrating substantial reach and impact.SolarWinds Orion was downloaded by approximately 18,000 customers, including government agencies and critical-infrastructure providers.
- Research gap: Existing research lacks a comprehensive, comprehensible, and general description of how attackers inject malicious code into OSS projects across technologies and stakeholders.
- Research questions: The study asks which general attack vectors and safeguards exist, how attack vectors can be represented usefully, and how safeguards are assessed and used.
- Contributions: The work contributes a taxonomy of 107 unique OSS supply-chain attack vectors represented as an attack tree and validated by 17 domain experts.
- Contributions: It also provides 33 safeguards assessed by experts and reports a qualitative assessment by 134 developers of attack awareness and protection.
A. Systems
The OSS supply chain comprises distributed systems and stakeholder roles spanning source control, building, distribution, and consumption. Automation, anonymity, limited visibility, and numerous dependencies expand both its technical and social attack surface.
- Systems: The modeled systems are VCSs, build systems, and package repositories, which may be roles implemented by one host or third-party service.
- Systems: VCSs host project code and metadata, build systems transform code into binary artifacts while resolving dependencies, and distribution platforms deliver artifacts to downstream users.
- Stakeholders: Stakeholder roles include maintainers, contributors, consumers, and system or service administrators, with multiple roles potentially held by one individual.
- Consumption: Package managers automate OSS downloads and installation, including resolution of transitive dependencies, across the technology stack and development lifecycle.
- Attack surface: Unknown stakeholders, distributed systems, limited consumer visibility, and many dependencies multiply the attack surface and make rigorous consumer review impractical.
D. Attack Tree
The paper uses attack trees to represent alternative ways of achieving malicious-code injection across the OSS supply chain. Its methodology combines literature review, abstraction and threat modeling, safeguard identification, and survey validation.
- Attack-tree model: Attack trees refine an attacker’s top-level goal into subgoals, with leaves representing increasingly concrete and actionable tasks.
- Attack-tree model: The taxonomy assumes disjunctive refinement, so child nodes represent alternative ways to reach a parent goal.
- Attacker model: The attacker’s goal is to place malicious code in OSS artifacts so it executes in downstream projects, while insider attacks and privileged access are out of scope.
- Methodology: The methodology has three phases: literature review, taxonomy and safeguard modeling, and validation through expert and developer surveys.
- Systematic Literature Review: The systematic literature review searched four digital libraries, reduced 1,025 deduplicated results to 99 included papers, and added 84 studies through snowballing.
Data Extraction:
The study extracts attack vectors from scientific and grey literature, classifies them within an OSS supply-chain attack scenario, and models them as a structured attack tree with mapped safeguards.
- Literature analysis: The selected scientific literature comprised 183 works reviewed for common threats, attack vectors, and related safeguards.
- Literature analysis: Grey literature was added to cover real-world attacks and vulnerabilities, using searches, filtering criteria, and snowballing.
- Attack modeling: Attack vectors were classified by analyzing OSS supply-chain stakeholders, systems, and relationships before attack-tree modeling.
- Attack modeling: Closed card-sorting and tree-testing supported construction of the attack-tree taxonomy using an attack-centric methodology.
- Attack modeling: The resulting structure identified 107 attack vectors instead of 19, organized by ecosystem interference, supply-chain stage, and involved systems or stakeholders.
- Safeguard mapping: Safeguards were classified by control type and stakeholder involvement, then mapped to the shallowest attack-tree nodes they partially or fully mitigate.
E. Survey Methodology
Two online surveys targeted domain experts and software developers for complementary validation and assessment of the taxonomy and safeguards. The questionnaires used tree-testing, interactive taxonomy exploration, and role-relevant ratings, with 17 expert and 134 developer respondents recruited through snowball sampling.
- Survey audiences: 17 experts validated the attack taxonomy and assessed safeguard utility and costs, while developers rated attack awareness and perceived protection.Developers could optionally assess taxonomy comprehensibility, usefulness, and safeguard use from an open-source consumer perspective.
- Taxonomy: Tree-testing assessed how easily experts assigned attack vectors to first-level nodes before they explored the complete taxonomy.The expert questionnaire then collected ratings of structure, node names, coverage, and usefulness.
- Safeguards: Experts assessed selected safeguards’ utility and costs, whereas developers rated safeguards relevant to their roles, including use and perceived costs when opting in.Safeguards were presented according to stakeholder roles involved in implementation.
- Survey refinement: The surveys were refined through user-research interviews and pretests involving 37 researchers and 14 master students.Feedback focused on shortening texts and improving presentation, especially for tree-testing content.
- Sampling: Snowball sampling recruited participants through professional networks, emails, LinkedIn, and presentations, so response rates could not be computed.The expert pool included relevant academic and industry experts; developers were recruited from practitioner networks.
- Timing and participation: The expert survey ran from 22 July 2021 and the developer survey from 19 October 2021, with both closing on 24 November 2021.The campaigns reached 17 experts and 134 developers.
Survey Procedure and Data Protection:
The paper’s taxonomy organizes OSS supply-chain attacks around how attackers place malicious code into artifacts consumed by downstream users. It covers package creation, naming, legitimate-project compromise, and codebase tampering, using literature-derived vectors and examples.
- Taxonomy scope: The analysis describes the taxonomy as built from 107 unique attack vectors collected through scientific and grey literature.The section also summarizes validation by experts and developers regarding awareness, understandability, and usefulness.
- Attacker goal: The attacker’s goal is to inject malicious code into OSS artifacts so downstream users download and execute it during installation or runtime.Targets may include libraries, word processors, direct consumers, or selected victims through conditional execution.
- Taxonomy structure: The attack tree’s first-level nodes represent different degrees of interference with existing packages.The tree unfolds below the high-level goal described for downstream execution.
- Distinct malicious packages: Developing and advertising a distinct malicious package involves creating an OSS project for malware distribution and attracting victims through repositories such as PyPI, npm, Docker Hub, or NuGet.Real-world examples affect all four named platforms.
- Name confusion: Name-confusion attacks deploy artifacts whose names resemble legitimate projects, suggest trustworthy authors, or exploit common naming patterns.Sub-techniques include combosquatting, altered word order, manipulated separators, and typosquatting.
- Legitimate-package compromise: Subverting a legitimate package requires corrupting one or more project resources, producing a larger subtree with repeated user and system compromise branches.The section then focuses on sub-techniques of this first-level category.
- Codebase tampering: Codebase injection can affect downstream users of both source and pre-built binary artifacts because malicious code becomes part of project builds and distribution.Attackers may contribute hypocrite merge requests, hide code through IDE-rendering weaknesses, or obtain maintainer privileges.
- Codebase tampering: Attackers can bypass contribution workflows by tampering with version-control systems through compromised accounts or configuration and software vulnerabilities.These paths provide insecure access to the legitimate project’s codebase.
Inject During the Build of Legitimate Package:
The taxonomy covers attacks that inject malicious code while building pre-built packages and attacks that tamper with their hosting, distribution, or download mechanisms. Its expert validation found substantial agreement on structure, completeness, usefulness, and major use cases.
- Build-time injection: Pre-built components can receive malicious code during build before publication, making detection more difficult, especially for compiled languages.Compared with source injection, this route has more limited spread but can conceal malicious code inside compiled packages.
- Package distribution: Distribution attacks tamper with package repositories, mirrors, CDNs, proxies, or other systems involved in hosting and downloading pre-built packages.The taxonomy includes mechanisms affecting package distribution and download across public and narrower-scope repositories.
- Taxonomy basis: 107 unique attack vectors were generalized from 183 scientific papers and grey literature, supported by 94 real-world attacks or vulnerabilities.The taxonomy was subsequently refined using domain-expert feedback.
- Expert validation: 234 of 311 expert tree-test assignments matched the initial structure, corresponding to 75% agreement.The test evaluated assignment of attack vectors to first-level nodes before experts saw the full taxonomy.
- Expert validation: 14 of 17 experts, or 82%, rated the overall taxonomy structure 4 or 5 on a five-point scale.The authors suggest that some node names may have been insufficiently self-explanatory without context.
- Expert validation: 12 of 17 experts, or 71%, agreed that the attack tree was complete.This result concerns expert assessment of attack-tree completeness.
- Usefulness: 15 experts, or 88%, rated the taxonomy useful for understanding the OSS supply-chain attack surface, while 12, or 71%, did so for attacker tactics and techniques.Only 5 experts, or 29%, considered it useful for understanding attackers’ cost-benefit considerations.
- Usefulness: Threat modeling, awareness and training, and risk assessment were the experts’ top three proposed use cases.The authors also mention penetration-test scoping as an additional possible use.
C. Validation and Assessment by Developers
The developer survey measured awareness of high-level attack vectors, perceived protection, and optional taxonomy usefulness. The broader work identifies 33 stakeholder-oriented safeguards mapped to the attack tree, while developers generally lacked certainty about their protection.
- Developer survey: 134 developers assessed awareness of high-level attack vectors and whether they or their organizations used mitigating safeguards.Optional questions covered taxonomy understandability and usefulness from the perspective of open-source consumers.
- Awareness: Awareness ranged from 120 developers, or 90%, for developing and advertising a distinct malicious package to 86, or 64%, for build-time injection.These figures concern the two highest and lowest awareness values reported.
- Perceived protection: For all but one vector, most developers did not know whether they were protected; for distinct malicious packages, 52% believed protection existed.For build-time injection and malicious-version distribution, 19 developers, or 14%, were sure no protection existed.
- Taxonomy assessment: 53 of 134 developers, or 40%, completed the optional taxonomy assessment; 41, or 77%, found it understandable and 46, or 87%, found it useful for awareness.The ratings use scores of 4 or 5.
- Validation conclusion: The taxonomy’s validation showed overall agreement among experts and developers regarding structure, naming, comprehensiveness, comprehensibility, and suitability for threat modeling, awareness, training, and risk assessment.This is the reported response to RQ1.2.
- Safeguards: Safeguard selection, combination, and implementation require balancing security levels against potentially nonnegligible costs.Costs depend partly on the programming languages and ecosystems involved.
- Safeguard categories: Safeguards span common stakeholder-wide measures, maintainer and administrator controls, project-maintainer practices, administrator and consumer controls, and consumer countermeasures.Examples include SBOMs, secure authentication, merge-request review, dedicated build services, source builds, isolation, sandboxing, and vetted mirrors.
- Safeguards: 33 general safeguards were identified, mostly detective or preventive, and mapped to attack-tree nodes they partially or fully mitigate.The safeguards are intended for maintainers, contributors, consumers, and administrators.
B. Experts Validation and Assessment
Experts assessed safeguard utility and costs, while developers reported safeguard use, awareness, and perceived protection. Utility was generally medium to high, but costs varied substantially across safeguards.
- Most safeguards received medium-to-high utility ratings, while mean cost ratings ranged from 2.0 to 4.8.
- Merge Request Reviews received the highest average utility rating at 4.6.
- 17 experts qualitatively assessed the utility and costs of 33 safeguards.
- Protect production branch, Remove un-used dependencies, and Version pinning had the best utility-to-cost ratios.
- Build Dependencies from Sources had the lowest utility-to-cost ratio and a mean and median utility rating of 3.0.
- 70% of developers knew about Create Name Confusion, but only a minority used its corresponding safeguards.
- Among 134 developers, the most-used safeguards were Remove un-used dependencies, Version pinning, and integrating an open-source vulnerability scanner into the CI/CD pipeline.
VI. DISCUSSION
The discussion examines how attack vectors and safeguards vary across ecosystems while emphasizing the taxonomy’s ecosystem-independent core. It positions the taxonomy and safeguard mapping as reference tools for security assessment and future research.
- Differences between Ecosystems: Many attack techniques, including Take-over Legitimate Account and Become Maintainer, are independent of ecosystems and programming languages.
- Differences between Ecosystems: Dependency-resolution attacks depend on package-manager behavior: Maven, npm, pip, NuGet, and Composer were affected by dependency confusion, whereas Go and Cargo were not.
- Differences between Ecosystems: Installation hooks commonly trigger malicious code in Python and Node.js, while compiled-language ecosystems more often rely on runtime payloads or poisoned test routines.
- Differences between Ecosystems: Safeguards are usually cross-ecosystem, but specific controls include Scoped packages for Node.js and Prevent script execution for Python and Node.js.
- Benefits of the Taxonomy for Future Research: The taxonomy offers a common reference and terminology for systematizing OSS supply-chain security knowledge.
- Benefits of the Taxonomy for Future Research: Its attack-vector and safeguard lists can support comparative security assessments across projects, ecosystems, and time.
- Benefits of the Taxonomy for Future Research: Reproducible builds address source-to-binary analysis challenges but are not commonly applied, are considered costly, and require substantial effort for complex projects.
VII. USER SURVEY DEMOGRAPHICS
The surveys drew on domain experts and software developers with relevant OSS experience, while the paper’s synthesis incorporated specific and general prior work. Participants and authors supported the taxonomy’s intended reference and assessment uses.
- 17 expert respondents were knowledgeable in supply-chain security and actively participated in OSS projects.
- 134 developer respondents were surveyed, and 121 respondents, or 90%, reported using open-source components in their daily jobs.
- The literature review included works addressing specific technologies, systems, stakeholder interactions, and broader supply-chain coverage.
- Prior work covered commit-based injection detection, social-engineering susceptibility, subverted compilers, and source-to-binary correspondence.
- Earlier general works included attack trees for malicious packages and frameworks addressing secure software-artifact distribution.
- The taxonomy was positively assessed for comprehensiveness, comprehensibility, and usefulness, but reflects the current state of the art and is expected to evolve with supply-chain technologies.
- The authors systematically reviewed literature and security news, then used expert feedback to assess completeness, while acknowledging that new attacks are likely to be discovered.
- The taxonomy can serve as a central reference, while mapped safeguards can help assess stakeholder exposure and optimize limited security budgets.
APPENDIX A SAFEGUARDS AGAINST OSS SUPPLY CHAIN ATTACKS
The appendix identifies safeguards against OSS supply-chain attacks and documents the literature and grey-literature resources used to construct the taxonomy. Safeguards are classified by control type, stakeholders, and mitigated attack vectors.
- The systematic literature review queried Google Scholar, arXiv, IEEE Xplore, and the ACM Digital Library.
- Table II lists safeguards, their control types, involved stakeholders, and mappings to mitigated attack vectors.
- The review also used Microsoft and Google whitepapers and security-project materials from SLSA, sigstore, TUF, in-toto, and OSSF Scorecard.
- Additional sources included security-news aggregators, package-repository and vendor blogs, security researchers, and cybersecurity-conference keynotes.
- Grey-literature sources included MITRE CAPEC, the IQT Lab Software Supply Chain Compromises dataset, and the Backstabber’s Knife Dataset.