{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,19]],"date-time":"2026-09-19T17:13:42Z","timestamp":1789838022529,"version":"4.0.1"},"reference-count":99,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"am","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,4,1]],"date-time":"2025-04-01T00:00:00Z","timestamp":1743465600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2207008"],"award-info":[{"award-number":["2207008"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100007703","name":"North Carolina State University Provost Doctoral Fellowship","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100007703","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Goodnight Doctoral Fellowship"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2025,4]]},"DOI":"10.1109\/tse.2025.3551664","type":"journal-article","created":{"date-parts":[[2025,3,18]],"date-time":"2025-03-18T17:35:53Z","timestamp":1742319353000},"page":"1319-1333","source":"Crossref","is-referenced-by-count":4,"title":["<i>Trusting Code in the Wild<\/i>: Exploring Contributor Reputation Measures to Review Dependencies in the Rust Ecosystem"],"prefix":"10.1109","volume":"51","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-8381-1436","authenticated-orcid":false,"given":"Sivana","family":"Hamer","sequence":"first","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1955-1924","authenticated-orcid":false,"given":"Nasif","family":"Imtiaz","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-3162-7580","authenticated-orcid":false,"given":"Mahzabin","family":"Tamanna","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4818-3662","authenticated-orcid":false,"given":"Preya","family":"Shabrina","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3300-6540","authenticated-orcid":false,"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"ref2","article-title":"What we know about the xz Utils backdoor that almost infected the world","author":"Goodin","year":"2024"},{"key":"ref3","article-title":"Backdoor in upstream xz\/liblzma leading to ssh server compromise","author":"Freund","year":"2024"},{"key":"ref4","article-title":"Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094","year":"2024"},{"key":"ref5","article-title":"Cve-2024-3094","year":"2024"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3181010"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-92317-4_4"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1002\/smr.1893"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179304"},{"key":"ref10","article-title":"Safeguarding artifact integrity across any software supply chain","year":"2024"},{"key":"ref11","article-title":"OpenSSF Scorecard","year":"2024"},{"key":"ref12","article-title":"Cargo-crev","year":"2024"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3279773"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3319509"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409711"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2022.111588"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1145\/3641822.3641865"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIS.2019.00014"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568315"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3165056"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1145\/2652524.2652544"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3510457.3513044"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616293"},{"key":"ref24","first-page":"2509","article-title":"$\\{${\u2018I$\\}$} wouldn\u2019t want my unsafe code to run my $\\{${pacemaker\u2019$\\}$}: An interview study use, comprehension, perceived risks unsafe rust","volume-title":"Proc. USENIX Secur. Symp.","author":"H\u00f6ltervennhoff","year":"2023"},{"key":"ref25","article-title":"Crates.io","year":"2024"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2020.110802"},{"key":"ref27","article-title":"Supplemental Material - Trusting code in the wild: Exploring contributor reputation measures to review dependencies in the Rust ecosystem","author":"Hamer","year":"2025"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2020.110618"},{"key":"ref29","doi-asserted-by":"crossref","first-page":"181","DOI":"10.1145\/3196398.3196401","article-title":"On the impact of security vulnerabilities in the NPM package dependency network","volume-title":"Proc. Int. Conf. Mining Softw. Repositories","author":"Decan","year":"2018"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23414"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1145\/3475716.3475769"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510104"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3560835.3564548"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP52600.2021.00035"},{"key":"ref35","article-title":"Keeping your supply chain secure with Dependabot","year":"2024"},{"key":"ref36","article-title":"Cargo-vet","year":"2024"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2022.3142338"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3639476.3639775"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/SP46214.2022.9833686"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/3503229.3547061"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-NIER58687.2023.00010"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180209"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1145\/3359224"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1145\/3544902.3546236"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/TEM.2021.3122012"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1145\/3555051.3555067"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.5040\/9781849668187"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1145\/1985793.1985832"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/CSMR.2013.41"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/2786805.2786854"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-019-09700-1"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.1371\/journal.pone.0226281"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2015.26"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2017.55"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9589-y"},{"key":"ref56","first-page":"995","article-title":"Small world with high risks: A study of security threats in the NPM ecosystem","volume-title":"Proc. USENIX Secur. Symp.","author":"Zimmermann","year":"2019"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1007\/s13278-018-0493-2"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1016\/j.tele.2018.11.008"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-59171-1_5"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/2981545"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1109\/ICECA49313.2020.9297562"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1093\/comnet\/cnz048"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1038\/s41597-022-01819-z"},{"key":"ref64","article-title":"Solana: A new architecture for a high performance blockchain v0","author":"Yakovenko","journal-title":"Whitepaper, 2018"},{"issue":"2327","key":"ref65","article-title":"Polkadot: Vision for a heterogeneous multi-chain framework","volume":"21","author":"Wood","year":"2016","journal-title":"White paper"},{"key":"ref66","article-title":"Rust Secure Code Working Group","year":"2024"},{"key":"ref67","article-title":"GitHub REST API documentation","year":"2024"},{"key":"ref68","article-title":"package-locator","year":"2024"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-45390-3_25"},{"key":"ref70","article-title":"Networkx: Network analysis with Python","author":"Hagberg","year":"2020"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.2307\/3033543"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1016\/0378-8733(78)90021-7"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1080\/0022250X.2001.9990249"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1016\/j.socnet.2007.04.002"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1016\/S0169-7552(98)00110-X"},{"key":"ref76","first-page":"1172","article-title":"Search in a small world","volume-title":"Ijcai","volume":"99","author":"Walsh","year":"1999"},{"key":"ref77","doi-asserted-by":"publisher","DOI":"10.1145\/2501654.2501661"},{"key":"ref78","doi-asserted-by":"publisher","DOI":"10.1038\/30918"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1017\/CBO9780511815478"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1016\/j.knosys.2017.10.029"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-03552-4_14"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1287\/ited.2013.0124"},{"key":"ref83","doi-asserted-by":"publisher","DOI":"10.1007\/s40593-023-00338-1"},{"key":"ref84","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-93846-2_11"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-10072-8"},{"key":"ref86","doi-asserted-by":"publisher","DOI":"10.4135\/9781071878781"},{"key":"ref87","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2023.111707"},{"key":"ref88","doi-asserted-by":"publisher","DOI":"10.1201\/9781315382722"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.1080\/01621459.1988.10478575"},{"key":"ref90","doi-asserted-by":"publisher","DOI":"10.1177\/0049124104268644"},{"key":"ref91","doi-asserted-by":"publisher","DOI":"10.1111\/j.2041-210x.2012.00261.x"},{"key":"ref92","first-page":"3099","article-title":"Account verification on social media: user perceptions and paid enrollment","volume-title":"Proc. USENIX Secur. Symp.","author":"Xiao","year":"2023"},{"key":"ref93","article-title":"Everything I know about the XZ backdoor","author":"Boehs","year":"2024"},{"key":"ref94","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2019.110460"},{"key":"ref95","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179378"},{"key":"ref96","article-title":"Alpha-omega","year":"2024"},{"key":"ref97","article-title":"Future directions","year":"2024"},{"key":"ref98","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2010.5463342"},{"key":"ref99","doi-asserted-by":"publisher","DOI":"10.1109\/CHASE.2013.6614738"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"https:\/\/ieeexplore.ieee.org\/ielam\/32\/10969500\/10932824-aam.pdf","content-type":"application\/pdf","content-version":"am","intended-application":"syndication"},{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/32\/10969500\/10932824.pdf?arnumber=10932824","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,4,18]],"date-time":"2025-04-18T17:38:03Z","timestamp":1744997883000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10932824\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,4]]},"references-count":99,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tse.2025.3551664","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"value":"0098-5589","type":"print"},{"value":"1939-3520","type":"electronic"},{"value":"2326-3881","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,4]]}}}