{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T15:12:30Z","timestamp":1781017950193,"version":"3.54.1"},"publisher-location":"New York, NY, USA","reference-count":27,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,3,23]],"date-time":"2026-03-23T00:00:00Z","timestamp":1774224000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,3,23]]},"DOI":"10.1145\/3748522.3779992","type":"proceedings-article","created":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T14:17:49Z","timestamp":1781014669000},"page":"1664-1672","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["SourceBroken: A large-scale analysis on the (un)reliability of SourceRank in the PyPI ecosystem"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-6870-8075","authenticated-orcid":false,"given":"Biagio","family":"Montaruli","sequence":"first","affiliation":[{"name":"EURECOM, Biot, France"},{"name":"SAP, Mougins, France"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6208-4743","authenticated-orcid":false,"given":"Serena Elisa","family":"Ponta","sequence":"additional","affiliation":[{"name":"SAP, Mougins, France"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0003-1072-4352","authenticated-orcid":false,"given":"Luca","family":"Compagna","sequence":"additional","affiliation":[{"name":"Endor Labs, Palo Alto, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5957-6213","authenticated-orcid":false,"given":"Davide","family":"Balzarotti","sequence":"additional","affiliation":[{"name":"EURECOM, Biot, France"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,9]]},"reference":[{"key":"e_1_3_2_1_1_1","volume-title":"How to evaluate the quality of python packages. Accessed","author":"Acsany Philipp","year":"2026","unstructured":"Philipp Acsany. 2025. How to evaluate the quality of python packages. Accessed: January 6, 2026. (2025). https:\/\/realpython.com\/python-package-quality\/."},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2018.07.023"},{"key":"e_1_3_2_1_3_1","volume-title":"PyPi Is Under Attack: Project Creation and User Registration Suspended. https:\/\/checkmarx.com\/blog\/pypi-is-under-attack-project-creation-and-user-registration-suspended. (Mar","year":"2024","unstructured":"Checkmarx. 2024. PyPi Is Under Attack: Project Creation and User Registration Suspended. https:\/\/checkmarx.com\/blog\/pypi-is-under-attack-project-creation-and-user-registration-suspended. (Mar. 2024)."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2002.1027797"},{"key":"e_1_3_2_1_5_1","unstructured":"Python Software Foundation. 2025. PyPI Malicious Packages. (2025). https:\/\/github.com\/pypi\/pypi-observation-reports-private."},{"key":"e_1_3_2_1_6_1","volume-title":"PyPI halted new users and projects while it fended off supply-chain attack. https:\/\/arstechnica.com\/security\/2024\/03\/pypi-halted-new-users-and-projects-while-it-fended-off-supply-chain-attack. (Mar","author":"Goodin Dan","year":"2024","unstructured":"Dan Goodin. 2024. PyPI halted new users and projects while it fended off supply-chain attack. https:\/\/arstechnica.com\/security\/2024\/03\/pypi-halted-new-users-and-projects-while-it-fended-off-supply-chain-attack. (Mar. 2024)."},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3603110"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1109\/QRS62785.2024.00057"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179304"},{"key":"e_1_3_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/3627106.3627138"},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3605770.3625212"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-Companion66252.2025.00014"},{"key":"e_1_3_2_1_13_1","unstructured":"Jasmine Latendresse SayedHassan Khatoonabadi Ahmad Abdellatif and Emad Shihab. 2024. Is chatgpt a good software librarian? an exploratory study on the use of chatgpt for software library recommendations. (2024). https:\/\/arxiv.org\/abs\/2408.05128."},{"key":"e_1_3_2_1_14_1","unstructured":"Jasmine Latendresse SayedHassan Khatoonabadi and Emad Shihab. 2025. How robust are llm-generated library imports? an empirical study using stack overflow. (2025). https:\/\/arxiv.org\/abs\/2507.10818."},{"key":"e_1_3_2_1_15_1","volume-title":"https:\/\/libraries.io\/api","author":"API.","year":"2025","unstructured":"Libraries.io. 2025. Libraries.io API. (2025). https:\/\/libraries.io\/api."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.25080\/Majora-92bf1922-00a"},{"key":"e_1_3_2_1_17_1","volume-title":"USENIX Security 23","author":"Neupane Shradha","year":"2023","unstructured":"Shradha Neupane, Grant Holmes, Elizabeth Wyss, Drew Davidson, and Lorenzo De Carli. 2023. Beyond typosquatting: an in-depth look at package confusion. In USENIX Security 23. USENIX Association, (Aug. 2023), 3439\u20133456. isbn: 978-1-939133-37-3. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/neupane."},{"key":"e_1_3_2_1_18_1","volume-title":"Openssf scorecard. Accessed","author":"Security Open Source","year":"2026","unstructured":"Open Source Security Foundation (OpenSSF). 2025. Openssf scorecard. Accessed: January 6, 2026. (2025). https:\/\/scorecard.dev."},{"key":"e_1_3_2_1_19_1","unstructured":"OpenSSF. 2025. OpenSSF Malicious Packages. (2025). https:\/\/github.com\/ossf\/malicious-packages."},{"key":"e_1_3_2_1_20_1","volume-title":"Semantic versioning (semver). Accessed","author":"Preston-Werner Tom","year":"2026","unstructured":"Tom Preston-Werner. 2025. Semantic versioning (semver). Accessed: January 6, 2026. (2025). https:\/\/semver.org."},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1002\/smr.2265"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3589334.3645510"},{"key":"e_1_3_2_1_23_1","volume-title":"10th Annual State of the Software Supply Chain. https:\/\/www.sonatype.com\/state-of-the-software-supply-chain\/Introduction. Accessed","year":"2026","unstructured":"Sonatype. 2024. 10th Annual State of the Software Supply Chain. https:\/\/www.sonatype.com\/state-of-the-software-supply-chain\/Introduction. Accessed: January 6, 2026. (2024)."},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-023-10317-8"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510127"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/3643991.3644883"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3279773"}],"event":{"name":"SAC '26: 41st ACM\/SIGAPP Symposium on Applied Computing","location":"Grand Hotel Palace Thessaloniki Greece","acronym":"SAC '26","sponsor":["SIGAPP ACM Special Interest Group on Applied Computing"]},"container-title":["Proceedings of the 41st ACM\/SIGAPP Symposium on Applied Computing"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3748522.3779992","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,9]],"date-time":"2026-06-09T14:18:32Z","timestamp":1781014712000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3748522.3779992"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,23]]},"references-count":27,"alternative-id":["10.1145\/3748522.3779992","10.1145\/3748522"],"URL":"https:\/\/doi.org\/10.1145\/3748522.3779992","relation":{},"subject":[],"published":{"date-parts":[[2026,3,23]]},"assertion":[{"value":"2026-06-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}