This article discusses open source software supply chain attacks and proposes a general taxonomy describing how attackers conduct them. We then provide a list of safeguards to mitigate such attacks. We present our tool Risk Explorer for Software Supply Chains to explore such information, and we discuss its industrial use-cases.

中文翻译：

---

软件供应链攻击中心之旅

本文讨论了开源软件供应链攻击，并提出了描述攻击者如何进行攻击的一般分类法。然后，我们提供一系列保护措施来减轻此类攻击。我们展示了软件供应链风险浏览器工具来探索此类信息，并讨论其工业用例。