{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,8,19]],"date-time":"2026-08-19T21:13:03Z","timestamp":1787173983104,"version":"build-2736575974"},"reference-count":75,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"10","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100012166","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2023YFB3106600"],"award-info":[{"award-number":["2023YFB3106600"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62472296"],"award-info":[{"award-number":["62472296"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1109\/tse.2025.3599732","type":"journal-article","created":{"date-parts":[[2025,8,19]],"date-time":"2025-08-19T18:15:55Z","timestamp":1755627355000},"page":"2847-2863","source":"Crossref","is-referenced-by-count":3,"title":["Wolf in Sheep\u2019s Clothing: Shearing the Camouflage of Malicious Java Components in Maven"],"prefix":"10.1109","volume":"51","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-4483-5427","authenticated-orcid":false,"given":"Yutong","family":"Zeng","sequence":"first","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5871-946X","authenticated-orcid":false,"given":"Cheng","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-9963-3997","authenticated-orcid":false,"given":"Jiaxuan","family":"Han","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-6913-9045","authenticated-orcid":false,"given":"Jianguo","family":"Zhao","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-4839-5571","authenticated-orcid":false,"given":"Nannan","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8412-7695","authenticated-orcid":false,"given":"Genpei","family":"Liang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-2985-9552","authenticated-orcid":false,"given":"Shuyi","family":"Jiang","sequence":"additional","affiliation":[{"name":"School of Cyber Science and Engineering, Sichuan University, Chengdu, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"9th annual state of the software supply chain","author":"Linskens","year":"2023"},{"key":"ref2","article-title":"Execution, tactic ta0002","year":"2018"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179304"},{"key":"ref4","article-title":"The history of maven central and sonatype: A journey from past to present","author":"Linskens","year":"2023"},{"key":"ref5","article-title":"Sonatype stops software supply chain attack aimed at the Java developer community","year":"2021"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3098954.3120928"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627138"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3705304"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-NIER.2019.00012"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3407023.3409183"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3420015"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468592"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2021.23055"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TrustCom53373.2021.00091"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00085"},{"key":"ref16","first-page":"3765","article-title":"Donapi: Malicious NPM packages detector using behavior sequence knowledge mapping","volume-title":"Proc. 33rd USENIX Secur. Symp. (USENIX Secur.)","author":"Huang","year":"2024"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3605770.3625212"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2021.102547"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2420988"},{"key":"ref20","article-title":"fastjson.","year":"2025"},{"key":"ref21","article-title":"cglib.","year":"2025"},{"key":"ref22","article-title":"malicious servlet api.\u201d","year":"2025"},{"key":"ref23","article-title":"jakarta servlet api.","year":"2025"},{"key":"ref24","article-title":"jakarta servlet api doget.","year":"2025"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3488932.3523262"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00073"},{"key":"ref27","article-title":"Guarddog.","year":"2022"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2017.53"},{"key":"ref29","article-title":"Dynamic proxy classes.","year":"2025"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1984.5010248"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/77606.77608"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250748"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/DSN58367.2023.00028"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564548"},{"key":"ref35","article-title":"Tabby Java API.","author":"Chen","year":"2025"},{"key":"ref36","article-title":"Maloss Java API.","author":"Duan","year":"2025"},{"key":"ref37","article-title":"Jimple: Simplifying Java bytecode for analyses and transformations","author":"Vallee-Rai","year":"1998"},{"issue":"35","key":"ref38","article-title":"The soot framework for Java program analysis: A retrospective","volume":"15","author":"Lam","year":"2011","journal-title":"Cetus Users Compiler InfaStruct. Workshop (CETUS)"},{"key":"ref39","article-title":"Program analysis and specialization for the C programming language","author":"Andersen","year":"1994"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3527332"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/966049.777394"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.1996.493444"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/DSN53405.2022.00026"},{"key":"ref44","article-title":"Efficient estimation of word representations in vector space","author":"Mikolov","year":"2013"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1807.06521"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"ref47","article-title":"Alisoft supply chain security competition"},{"key":"ref48","article-title":"Spark: A flexible points-to analysis framework for Java","author":"Lhot\u00e1k","year":"2003"},{"key":"ref49","article-title":"Kaspersky.","year":"2025"},{"key":"ref50","article-title":"The classification tree.","year":"2025"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417291"},{"key":"ref52","article-title":"VirusTotal.","year":"2024"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3512766"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/SANER60148.2024.00028"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670310"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1145\/1455770.1455841"},{"key":"ref57","first-page":"3439","article-title":"Beyond typosquatting: An in-depth look at package confusion","volume-title":"Proc. 32nd USENIX Secur. Symp. (USENIX Secur.)","author":"Neupane","year":"2023"},{"key":"ref58","first-page":"995","article-title":"Small world with high risks: A study of security threats in the NPM ecosystem","volume-title":"Proc. 28th USENIX Secur. Symp. (USENIX Secur.)","author":"Zimmermann","year":"2019"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00135"},{"key":"ref60","article-title":"Typosquatting in programming language package managers","author":"Tschacher","year":"2016"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSPW51379.2020.00074"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-65745-1_7"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/ASE51524.2021.9678526"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00052"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1145\/3544968"},{"key":"ref66","first-page":"49","article-title":"Android malware family classification and characterization using CFG and DFG","volume-title":"Proc. Int. Symp. Theor. Aspects Softw. Eng. (TASE)","author":"Zhiwu","year":"2019"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/TMC.2020.3007260"},{"key":"ref68","first-page":"729","article-title":"TESSERACT: Eliminating experimental bias in malware classification across space and time","volume-title":"Proc. 28th USENIX Secur. Symp. (USENIX Secur.)","author":"Pendlebury","year":"2019"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2014.23247"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1145\/3417978"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.117833"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1016\/j.neucom.2020.10.054"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2023.121125"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1145\/3313391"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00085"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/32\/11207080\/11129930.pdf?arnumber=11129930","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,20]],"date-time":"2025-10-20T17:49:19Z","timestamp":1760982559000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11129930\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":75,"journal-issue":{"issue":"10"},"URL":"https:\/\/doi.org\/10.1109\/tse.2025.3599732","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"value":"0098-5589","type":"print"},{"value":"1939-3520","type":"electronic"},{"value":"2326-3881","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,10]]}}}