{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,25]],"date-time":"2026-02-25T17:13:44Z","timestamp":1772039624366,"version":"3.50.1"},"publisher-location":"New York, NY, USA","reference-count":32,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,7,24]],"date-time":"2024-07-24T00:00:00Z","timestamp":1721779200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,7,24]]},"DOI":"10.1145\/3671016.3671402","type":"proceedings-article","created":{"date-parts":[[2024,7,17]],"date-time":"2024-07-17T20:19:32Z","timestamp":1721247572000},"page":"457-466","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["Decoding Web3: In-depth Analysis of the Third-Party Package Supply Chain"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0006-5459-3229","authenticated-orcid":false,"given":"Kai","family":"Ma","sequence":"first","affiliation":[{"name":"Huazhong University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0007-5735-2401","authenticated-orcid":false,"given":"Zhuo","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8793-5367","authenticated-orcid":false,"given":"Yanjie","family":"Zhao","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1100-8633","authenticated-orcid":false,"given":"Haoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Huazhong University of Science and Technology, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,7,24]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2023. Ledger dApp supply chain attack steals 600K from crypto wallets. https:\/\/www.bleepingcomputer.com\/news\/security\/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets."},{"key":"e_1_3_2_1_2_1","unstructured":"2023. Ledger Supply Chain Breach: 600 000 Theft Unveiled. https:\/\/tuxcare.com\/blog\/ledger-supply-chain-breach-600000-theft-unveiled\/."},{"key":"e_1_3_2_1_3_1","unstructured":"2023. Supply Chain Attack on Ledger Connect Kit: Analyzing the Impact and Preventive Measures. https:\/\/slowmist.medium.com\/supply-chain-attack-on-ledger-connect-kit-analyzing-the-impact-and-preventive-measures-1005e39422fd."},{"key":"e_1_3_2_1_4_1","unstructured":"2024. Cargo. https:\/\/crates.io\/."},{"key":"e_1_3_2_1_5_1","unstructured":"2024. Common Weakness Enumeration. https:\/\/cwe.mitre.org\/."},{"key":"e_1_3_2_1_6_1","unstructured":"2024. Decentralized Applications (dApps): Definition Uses Pros and Cons. https:\/\/www.investopedia.com\/terms\/d\/decentralized-applications-dapps.asp."},{"key":"e_1_3_2_1_7_1","unstructured":"2024. GitHub Advisory Database. https:\/\/github.com\/advisories."},{"key":"e_1_3_2_1_8_1","unstructured":"2024. Latent Dirichlet allocation. https:\/\/en.wikipedia.org\/wiki\/Latent_Dirichlet_allocation."},{"key":"e_1_3_2_1_9_1","unstructured":"2024. Ledger Connect Kit. https:\/\/github.com\/ledgerhq\/connect-kit."},{"key":"e_1_3_2_1_10_1","unstructured":"2024. NATIONAL VULNERABILITY DATABASE. https:\/\/nvd.nist.gov\/."},{"key":"e_1_3_2_1_11_1","unstructured":"2024. NPM. https:\/\/www.npmjs.com\/."},{"key":"e_1_3_2_1_12_1","unstructured":"2024. Package manager - Wikipedia. https:\/\/en.wikipedia.org\/wiki\/Package_manager."},{"key":"e_1_3_2_1_13_1","unstructured":"2024. Pyevolve. https:\/\/pyevolve.sourceforge.net\/."},{"key":"e_1_3_2_1_14_1","unstructured":"2024. PyPI. https:\/\/pypi.org\/."},{"key":"e_1_3_2_1_15_1","unstructured":"2024. Semantic Versioning. https:\/\/semver.org\/."},{"key":"e_1_3_2_1_16_1","unstructured":"2024. Software supply chain. https:\/\/en.wikipedia.org\/wiki\/Software_supply_chain."},{"key":"e_1_3_2_1_17_1","volume-title":"Proccedings of the 10th european conference on software architecture workshops. 1\u20134.","author":"Decan Alexandre","unstructured":"Alexandre Decan, Tom Mens, and Maelick Claes. 2016. On the topology of package dependency networks: A comparison of three programming language ecosystems. In Proccedings of the 10th european conference on software architecture workshops. 1\u20134."},{"key":"e_1_3_2_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2017.7884604"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196398.3196401"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9589-y"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3345629.3345634"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3273934.3273942"},{"key":"e_1_3_2_1_23_1","volume-title":"Characterizing Deep Learning Package Supply Chains in PyPI: Domains, Clusters, and Disengagement. ACM Transactions on Software Engineering and Methodology","author":"Gao Kai","year":"2023","unstructured":"Kai Gao, Runzhi He, Bing Xie, and Minghui Zhou. 2023. Characterizing Deep Learning Package Supply Chains in PyPI: Domains, Clusters, and Disengagement. ACM Transactions on Software Engineering and Methodology (2023)."},{"key":"e_1_3_2_1_24_1","volume-title":"Cargo Ecosystem Dependency-Vulnerability Knowledge Graph Construction and Vulnerability Propagation Study. arXiv preprint arXiv:2210.07482","author":"Jia Peiyang","year":"2022","unstructured":"Peiyang Jia, Chengwei Liu, Hongyu Sun, Chengyi Sun, Mianxue Gu, Yang Liu, and Yuqing Zhang. 2022. Cargo Ecosystem Dependency-Vulnerability Knowledge Graph Construction and Vulnerability Propagation Study. arXiv preprint arXiv:2210.07482 (2022)."},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2017.55"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510142"},{"key":"e_1_3_2_1_27_1","volume-title":"Make web3. 0 connected","author":"Liu Zhuotao","year":"2021","unstructured":"Zhuotao Liu, Yangxi Xiang, Jian Shi, Peng Gao, Haoyu Wang, Xusheng Xiao, Bihan Wen, Qi Li, and Yih-Chun Hu. 2021. Make web3. 0 connected. IEEE transactions on dependable and secure computing 19, 5 (2021), 2965\u20132981."},{"key":"e_1_3_2_1_28_1","first-page":"1","article-title":"Out of sight, out of mind? How vulnerable dependencies affect open-source projects","volume":"26","author":"Artha\u00a0Azriadi Prana Gede","year":"2021","unstructured":"Gede Artha\u00a0Azriadi Prana, Abhishek Sharma, Lwin\u00a0Khin Shar, Darius Foo, Andrew\u00a0E Santosa, Asankhaya Sharma, and David Lo. 2021. Out of sight, out of mind? How vulnerable dependencies affect open-source projects. Empirical Software Engineering 26 (2021), 1\u201334.","journal-title":"Empirical Software Engineering"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616270"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510199"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2901743"},{"key":"e_1_3_2_1_32_1","volume-title":"28th USENIX Security Symposium. 995\u20131010","author":"Zimmermann Markus","year":"2019","unstructured":"Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small world with high risks: A study of security threats in the npm ecosystem. In 28th USENIX Security Symposium. 995\u20131010."}],"event":{"name":"Internetware 2024: 15th Asia-Pacific Symposium on Internetware","location":"Macau China","acronym":"Internetware 2024","sponsor":["SIGSOFT ACM Special Interest Group on Software Engineering"]},"container-title":["Proceedings of the 15th Asia-Pacific Symposium on Internetware"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3671016.3671402","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3671016.3671402","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,23]],"date-time":"2025-08-23T00:36:22Z","timestamp":1755909382000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3671016.3671402"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,24]]},"references-count":32,"alternative-id":["10.1145\/3671016.3671402","10.1145\/3671016"],"URL":"https:\/\/doi.org\/10.1145\/3671016.3671402","relation":{},"subject":[],"published":{"date-parts":[[2024,7,24]]},"assertion":[{"value":"2024-07-24","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}