{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T05:02:19Z","timestamp":1784955739381,"version":"3.55.0"},"reference-count":40,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"National Science Foundation"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1109\/icsa66085.2026.00014","type":"proceedings-article","created":{"date-parts":[[2026,7,24]],"date-time":"2026-07-24T19:12:43Z","timestamp":1784920363000},"page":"78-89","source":"Crossref","is-referenced-by-count":0,"title":["Changing Nothing, Yet Changing Everything: Exploring Rug Pulls in GitHub Workflows"],"prefix":"10.1109","author":[{"given":"Edoardo","family":"Riggio","sequence":"first","affiliation":[{"name":"USI","place":["Lugano, Switzerland"]}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Cesare","family":"Pautasso","sequence":"additional","affiliation":[{"name":"USI","place":["Lugano, Switzerland"]}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1109\/icsme55016.2022.00029"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/icse-seip52600.2021.00037"},{"key":"ref3","article-title":"Undersdtanding GitHub Actions"},{"key":"ref4","article-title":"Supply Chain Compromise of Third-Party tj-actions\/changed-files (CVE-2025-30066) and reviewdog\/action-setup@v1 (CVE-2025-30154)"},{"key":"ref5","article-title":"About Custom Actions"},{"key":"ref6","article-title":"Secure Use Reference"},{"key":"ref7","first-page":"2747","article-title":"Characterizing the Security of Github CI Workflows","volume-title":"Proceedings of the 31st USENIX Security Symposium (USENIX Security)","author":"Koishybayev"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/scam63643.2024.00015"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-032-12089-2_14"},{"key":"ref10","article-title":"Vulnerability Management Program: Building a Risk-Based Framework","year":"2024"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/QRS51102.2020.00065"},{"key":"ref12","article-title":"Replication Package for the paper: Changing Nothing, Yet Changing Everything: Exploring Rug Pulls in GitHub Workflows","author":"Riggio","year":"2026"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3643991.3644873"},{"key":"ref14","article-title":"GitHub Advisory Database"},{"key":"ref15","article-title":"Open Source Vulnerabilities"},{"key":"ref16","article-title":"Vulnerability metrics"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/icpc66645.2025.00016"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564554"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3643662.3643961"},{"key":"ref20","article-title":"Immutable releases"},{"key":"ref21","article-title":"Strategies for the Integration of Software Supply Chain Security in DevSecOps CI\/CD pipelines","volume-title":"Tech. Rep. NIST SP 800-204D","author":"Chandramouli","year":"2024"},{"key":"ref22","article-title":"The State of Open Source Security 2024","year":"2024"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3762635"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1145\/3714464"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/msec.2022.3173123"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-14179-9_19"},{"key":"ref27","article-title":"MITRE ATT&CK Framework"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/msec.2022.3142338"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/msr.2017.55"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9589-y"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1109\/saner50967.2021.00048"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3190562"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2901743"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3196398.3196401"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510142"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/qrs-c55045.2021.00163"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2023.111827"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/svm59160.2023.00006"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/sp46214.2022.9833803"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3643991.3644899"}],"event":{"name":"2026 IEEE 23rd International Conference on Software Architecture (ICSA)","location":"Amsterdam, Netherlands","start":{"date-parts":[[2026,6,22]]},"end":{"date-parts":[[2026,6,26]]}},"container-title":["2026 IEEE 23rd International Conference on Software Architecture (ICSA)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11612757\/11612759\/11613072.pdf?arnumber=11613072","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,25]],"date-time":"2026-07-25T04:37:31Z","timestamp":1784954251000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11613072\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":40,"URL":"https:\/\/doi.org\/10.1109\/icsa66085.2026.00014","relation":{},"subject":[],"published":{"date-parts":[[2026,6]]}}}