Pith. sign in

REVIEW 3 major objections 5 minor 2 cited by

Unveiling Large Language Model Supply Chain: Structure, Domain, and Vulnerabilities

T0 review · 3 major / 5 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The open-source LLM supply chain is a few giant hubs around many tiny trees, and its vulnerabilities peak at the third dependency layer.

desk verdict Useful but sloppy first map of the LLM supply chain; graph-size inconsistencies and the overclaimed 'first' status need fixing before the numbers can be trusted. read the letter →

arxiv 2504.20763 v2 pith:2Y6PM3T5 submitted 2025-04-29 cs.SE

Yanzhe Hu , Shenao Wang , Tianyuan Nie , Yanjie Zhao , Haoyu Wang This is my paper · ORCID
classification cs.SE
keywords largelanguagemodelsupplychainsoftwaresecuritydependencygraphanalysisvulnerabilitypropagationecosystemtopologyPyPINPMempiricalengineering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper sets out to show that the supply chain of open-source packages used to build and run large language models has a measurable shape: a few very large dependency hubs surrounded by many tiny, mostly isolated trees. It maps 15,725 LLM-related packages from the two major open-source package registries into a directed dependency graph, classifies the packages into 14 functional domains, and overlays 180 known vulnerabilities. The central empirical claim is that the ecosystem is locally dense but globally sparse: 79.7% of dependency trees have fewer than five nodes, while the ten largest trees account for 77.66% of all nodes. It also finds that vulnerabilities spread most in the first three dependency layers, peaking at an average of 237.8 affected downstream nodes at layer three, with hub packages such as transformers concentrating that risk. A sympathetic reader would take the paper as establishing quantitative ground truth for an ecosystem whose structure had previously been largely unknown.

What carries the argument

The operative object is the LLM supply chain dependency graph, a directed graph whose nodes are package-version pairs plus 180 vulnerability nodes and whose edges are dependency links and affects links. From this graph the paper extracts rooted dependency trees and classifies their internal wiring into named substructures, namely chains, triangles, diamonds, stars, and cycles, then measures vulnerability spread by counting how many downstream nodes sit one, two, or three layers away from a vulnerable root. It also uses composite centrality, defined as betweenness centrality divided by degree centrality, to flag bridge nodes that connect otherwise separate clusters. The layer counts are the mechanism that turns the static graph into a risk statement: propagation is concentrated in the first three transmissions.

What would settle it

Choose a sample of the 180 reported vulnerabilities, build call graphs or trace execution to see whether each downstream package actually reaches the vulnerable function, and compare the reachable counts with the reported layer averages; if the reachable counts are far smaller, the propagation numbers are best read as structural exposure rather than realized risk.

Watch

Extended reading notes

Core claim

The paper's central discovery is quantitative: the LLM supply chain is not a flat crowd of packages but a hierarchy in which 404 dependency trees range from two nodes to 3,094 nodes, with 79.7% of trees below five nodes and the ten largest trees containing 77.66% of all nodes. Inside these trees the dominant substructures are diamonds and triangles, indicating heavy reuse of shared intermediate libraries, and a small set of high-out-degree hubs carries most of the downstream load. On the security side, the paper reports that the 180 curated vulnerabilities propagate from an average of 8.3 directly affected package nodes at layer 1 to 142.1 at layer 2 and 237.8 at layer 3 before declining in deeper layers. A single example, CVE-2023-6730 in transformers, reaches 1,336 downstream nodes. The paper also finds that Plugins/External Tools packages make up 44.26% of the ecosystem, and that most workflows pass through LLM inference and external-tool packages.

Load-bearing premise

Vulnerability propagation is measured by counting every downstream package whose dependency tree contains a vulnerable package, without checking whether the vulnerable code is actually imported and invoked; the paper itself notes this, so the reported layer averages are upper bounds on reachability rather than confirmed exploit counts.

Editorial extensions

If this is right

  • Securing the ten largest dependency trees protects most of the ecosystem, because those trees contain 77.66% of all nodes.
  • Patching effort should target the first three dependency layers, where the average affected-node count rises from 8.3 to 237.8 before falling off.
  • High-out-degree hubs such as transformers are single points of failure; a single vulnerability in such a package can touch more than 1,300 downstream packages.
  • The 14-domain classification shows where risk concentrates, with Plugins/External Tools dominating at 44.26% and driving most domain transitions.
  • The published dataset and graph construction pipeline allow the measurements to be replicated and tracked as the ecosystem grows.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the locally dense, globally sparse shape may be a general signature of fast-growing developer ecosystems, and re-running this construction on model hubs, agent frameworks, or vector-database ecosystems would test that.
  • Editorial inference: the layer-3 peak suggests a concrete patching heuristic, namely quarantine or update packages within three hops of a vulnerable core, but the paper does not test whether that policy reduces realized exploitation.
  • Editorial inference: because affected-node counts are computed from dependency presence rather than code reachability, re-analyzing the same vulnerabilities with call-graph or runtime tracing would probably yield lower numbers and would convert these upper bounds into risk estimates.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper reports the first empirical study of the large language model supply chain (LLMSC), defined as the open-source packages, libraries, and tools used to develop, deploy, and maintain LLMs. The authors collect metadata and READMEs for 44,303 PyPI and NPM packages, filter them with a keyword search plus a two-stage heuristic classification using DeepSeek-V3, and obtain 15,725 LLM-related packages across 14 functional domains. They then construct a directed dependency graph, attach 180 curated vulnerability records from huntr, GitHub Advisory, and MITRE, and examine three research questions: structural topology, domain distribution and evolution, and vulnerability propagation. The main findings are that the graph is locally dense but globally sparse, with 79.7% of dependency trees containing fewer than 5 nodes, that ten large trees account for 77.66% of nodes, and that critical vulnerabilities propagate to an average of 142.1 nodes at layer 2 and 237.8 at layer 3 of dependency trees. The paper also analyzes domain transitions and identifies hub packages such as transformers as high-risk bridges.

Significance. If the results are reproducible, this is a useful and timely empirical contribution to software supply chain security. The paper addresses a genuinely under-explored ecosystem, provides quantitative structural and vulnerability-propagation claims, and connects them to concrete security risks in widely used packages such as transformers and llama-index. The described pipeline, including the keyword-based collection, the version-aware graph construction, and the multi-source vulnerability curation, is a reasonable methodology for a first characterization study. The paper also makes appropriate connections to prior work on NPM, Maven, PyPI, and deep-learning supply chains. However, the absence of released artifacts and the unresolved inconsistencies in graph sizes across sections currently prevent independent verification of the headline numbers.

major comments (3)
  1. [Abstract, §II-A, §II-B, Table II]
  2. [§V-B, Table VII, §VI]
  3. [§II-A, §II-B, Contributions]
minor comments (5)
  1. [Abstract vs. Full Text]
  2. [Table IV]
  3. [Table VII]
  4. [Figure 7]
  5. [§III-B]

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline statistics are direct measurements over an independently constructed graph, and the only definitional element (affected-node counts as transitive dependents) is explicitly disclosed as an upper-bound limitation.

full rationale

This paper is an empirical measurement study rather than a derivation or prediction pipeline. The structural statistics (404 dependency trees, 79.7% below five nodes, 77.66% in the ten largest trees, hub degrees) are direct graph metrics computed from dependency relationships collected from PyPI and NPM metadata. The vulnerability-propagation numbers (142.1 at layer 2, 237.8 at layer 3) are reachability counts over those constructed dependency trees, not outputs of a fitted model. The paper itself flags in Section VI that "the presence of a vulnerable package in a dependency tree does not guarantee an impact on downstream projects," so the reported counts are transparently an upper bound on topological reachability rather than a claimed measure of actual exploitation. There is no fitted parameter being renamed as a prediction, and no result is defined in terms of the claim it is supposed to establish. Self-citations to the authors' prior work ([10], [37]) supply the LLMSC definition and the lifecycle taxonomy used for domain classification, but these definitions do not force the measured graph statistics, which come from external registries, GitHub Advisory, MITRE, and huntr. The graph-size inconsistencies across abstract and Section II are reproducibility concerns, not circularity. No circular step is exhibited in the paper.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No numeric free parameters are introduced; the analysis is descriptive. The central numbers depend on assumptions about package classification, vulnerability mapping, and what "affected" means, listed above. No new physical or conceptual entities are postulated.

assumptions (4)
  • domain assumption README content and package metadata reliably indicate whether a package is LLM-related and which functional domain it belongs to.
    Invoked in Section II-A filtering and Section IV-A domain classification; errors here propagate into all prevalence statistics.
  • domain assumption Vulnerability records from MITRE, GitHub Advisory, and huntr are complete and correctly mapped to packages via repository name.
    Invoked in Section II-A; the 180-vulnerability set and all propagation numbers depend on this mapping.
  • domain assumption Counting all transitive dependents of a vulnerable package as affected nodes approximates security risk.
    Used in Section V-B propagation analysis; the paper itself concedes in Section VI that function-level invocation is required for real impact.
  • domain assumption Using the latest version as a fallback for unresolved dependency declarations does not distort the graph structure.
    Stated in Section II-B version normalization; affects edges and downstream reachability counts.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Unveiling Large Language Model Supply Chain: Structure, Domain, and Vulnerabilities." pith.science (2026). https://pith.science/paper/2Y6PM3T5

@misc{pith2026250420763,
  author       = {Pith},
  title        = {Pith review of: Unveiling Large Language Model Supply Chain: Structure, Domain, and Vulnerabilities},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2Y6PM3T5}},
  note         = {Machine review of arXiv:2504.20763}
}
read the original abstract

Large Language Models (LLMs) have revolutionized artificial intelligence (AI), driving breakthroughs in natural language understanding, text generation, and autonomous systems. However, the rapid growth of LLMs presents significant challenges in the security and reliability of the Large Language Model Supply Chain (LLMSC), a complex network of open-source components, libraries, and tools essential for LLM development and deployment. Despite its critical importance, the LLMSC remains underexplored, particularly regarding its structural characteristics, domain composition, and security vulnerabilities. To address this gap, we conduct the first empirical study of the LLMSC, analyzing a curated dataset of open-source packages from PyPI and NPM across 14 functional domains. We construct a directed dependency graph comprising 13,486 nodes, 28,704 edges, and 180 unique vulnerabilities to investigate the structural characteristics of the LLMSC and analyze how security risks propagate through its dependency network. Our findings reveal that the LLMSC exhibits a locally dense, globally sparse topology, with 72.38% of dependency trees containing fewer than 5 nodes, while a few large trees dominate the ecosystem, accounting for 77.66% of all nodes. The graph is characterized by high-degree hubs, with the top 5 most connected nodes averaging 1,207 dependents each. Security analysis shows that critical vulnerabilities propagate to an average of 142.1 nodes at the second layer of dependency trees and peak at 237.8 affected nodes at the third layer. Notably, cascading risks are concentrated in critical hub nodes such as \texttt{transformers}, which directly or indirectly affect over 1,300 downstream packages. These findings provide quantitative insights into the structural and security dynamics of the LLMSC and emphasize the need for targeted mitigation strategies to enhance ecosystem resilience.

Figures

Figures reproduced from arXiv: 2504.20763 by the authors.

Figure 1
Figure 1. The word cloud visualization of the keywords used [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Representative examples of topological substructures in dependency trees. An edge pointing from A to B indicates that [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Distribution of shared dependency nodes and paths. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Domain transition heatmap. The heatmap visualizes the [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Comparison of in-degree and out-degree distributions [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 7
Figure 7. Figure 7: Temporal trends of vulnerabilities in the LLMSC, [PITH_FULL_IMAGE:figures/full_fig_p009_7.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Decision-Level Hijacking: Injecting Cognitive Bias into Large Language Models via Bit-Flip Attacks

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A handful of weight-bit flips (as few as 12) can bias LLM outputs toward a target entity or stance, with limited effect on non-target tasks and output distributions.

  2. Long-range machine-learning potentials with environment-dependent charges enable predicting LO-TO splitting and dielectric constants

    physics.comp-ph 2026-03 unverdicted novelty 5.0 of 10

    Environment-dependent, optionally charge-conserving Coulomb terms grafted onto Moment Tensor Potentials recover LO–TO splitting and experimental dielectric constants for NaCl and improve dimer binding curves.

Reference graph

Works this paper leans on

46 extracted references · 18 canonical work pages · cited by 2 Pith papers

  1. [11]

    Lifting the veil on the large language model supply chain: Composition, risks, and mitigations,

    K. Huang, B. Chen, Y . Lu, S. Wu, D. Wang, Y . Huang, H. Jiang, Z. Zhou, J. Cao, and X. Peng, “Lifting the veil on the large language model supply chain: Composition, risks, and mitigations,” CoRR, vol. abs/2410.21218, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2410.21218

    arXiv doi:10.48550/arxiv.2410.21218 2024

  2. [37]

    Sok: Understanding vulnerabilities in the large language model supply chain,

    S. Wang, Y . Zhao, Z. Liu, Q. Zou, and H. Wang, “Sok: Understanding vulnerabilities in the large language model supply chain,” CoRR, vol. abs/2502.12497, 2025. [Online]. Available: https://doi.org/10.48550/arXiv.2502.12497

    arXiv doi:10.48550/arxiv.2502.12497 2025

  3. [1]

    Using an llm to help with code understanding,

    D. Nam, A. Macvean, V . Hellendoorn, B. Vasilescu, and B. Myers, “Using an llm to help with code understanding,” in Proceedings of the IEEE/ACM 46th International Conference on Software Engineering, ser. ICSE ’24. New York, NY , USA: Association for Computing Machinery,

  4. [2]

    Deepseek-vl: Towards real-world vision-language understanding,

    H. Lu, W. Liu, B. Zhang, B. Wang, K. Dong, B. Liu, J. Sun, T. Ren, Z. Li, H. Yang, Y . Sun, C. Deng, H. Xu, Z. Xie, and C. Ruan, “Deepseek-vl: Towards real-world vision-language understanding,” CoRR, vol. abs/2403.05525, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2403.05525

    arXiv doi:10.48550/arxiv.2403.05525 2024

  5. [3]

    A survey of large language models,

    W. X. Zhao, K. Zhou, J. Li, T. Tang, X. Wang, Y . Hou, Y . Min, B. Zhang, J. Zhang, Z. Dong, Y . Du, C. Yang, Y . Chen, Z. Chen, J. Jiang, R. Ren, Y . Li, X. Tang, Z. Liu, P. Liu, J. Nie, and J. Wen, “A survey of large language models,” CoRR, vol. abs/2303.18223, 2023. [Online]. Available: https://doi.org/10.48550/arXiv.2303.18223

    arXiv doi:10.48550/arxiv.2303.18223 2023

  6. [4]

    Chatgpt is not all you need. A state of the art review of large generative AI models,

    R. Gozalo-Brizuela and E. C. Garrido-Merch ´an, “Chatgpt is not all you need. A state of the art review of large generative AI models,” CoRR, vol. abs/2301.04655, 2023. [Online]. Available: https://doi.org/10.48550/arXiv.2301.04655

    arXiv doi:10.48550/arxiv.2301.04655 2023

  7. [5]

    Large language models for software engineering: A systematic literature review,

    X. Hou, Y . Zhao, Y . Liu, Z. Yang, K. Wang, L. Li, X. Luo, D. Lo, J. Grundy, and H. Wang, “Large language models for software engineering: A systematic literature review,” ACM Trans. Softw. Eng. Methodol. , vol. 33, no. 8, Dec. 2024. [Online]. Available: https://doi.org/10.1145/3695988

    doi:10.1145/3695988 2024

  8. [6]

    From llms to llm-based agents for software engineering: A survey of current, challenges and future,

    H. Jin, L. Huang, H. Cai, J. Yan, B. Li, and H. Chen, “From llms to llm-based agents for software engineering: A survey of current, challenges and future,” CoRR, vol. abs/2408.02479, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2408.02479

    arXiv doi:10.48550/arxiv.2408.02479 2024

Show all 46 references
  1. [7]

    Agents in software engineering: Survey, landscape, and vision,

    Y . Wang, W. Zhong, Y . Huang, E. Shi, M. Yang, J. Chen, H. Li, Y . Ma, Q. Wang, and Z. Zheng, “Agents in software engineering: Survey, landscape, and vision,” CoRR, vol. abs/2409.09030, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2409.09030

    2024 doi arXiv

  2. [8]

    Autogen: Enabling next-gen LLM applications via multi-agent conversation framework,

    Q. Wu, G. Bansal, J. Zhang, Y . Wu, S. Zhang, E. Zhu, B. Li, L. Jiang, X. Zhang, and C. Wang, “Autogen: Enabling next-gen LLM applications via multi-agent conversation framework,” CoRR, vol. abs/2308.08155,

    arXiv

  3. [10]

    Large language model supply chain: A research agenda,

    S. Wang, Y . Zhao, X. Hou, and H. Wang, “Large language model supply chain: A research agenda,” ACM Trans. Softw. Eng. Methodol. , Dec. 2024, just Accepted. [Online]. Available: https://doi.org/10.1145/3708531

    2024 doi

  4. [12]

    Large language model supply chain: Open problems from the security perspective,

    Q. Hu, X. Xie, S. Chen, and L. Ma, “Large language model supply chain: Open problems from the security perspective,” CoRR, vol. abs/2411.01604, 2024. [Online]. Available: https://doi.org/10.48550/ arXiv.2411.01604

    2024 doi arXiv

  5. [13]

    Owasp top 10 for large lan- guage model applications,

    OW ASP, “Owasp top 10 for large lan- guage model applications,” https://owasp.org/ www-project-top-10-for-large-language-model-applications/, 2025, accessed: 2025-04-23

    2025

  6. [14]

    Models are codes: Towards measuring malicious code poisoning attacks on pre-trained model hubs,

    J. Zhao, S. Wang, Y . Zhao, X. Hou, K. Wang, P. Gao, Y . Zhang, C. Wei, and H. Wang, “Models are codes: Towards measuring malicious code poisoning attacks on pre-trained model hubs,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering...

    2024

  7. [15]

    Agentpoison: Red-teaming LLM agents via poisoning memory or knowledge bases,

    Z. Chen, Z. Xiang, C. Xiao, D. Song, and B. Li, “Agentpoison: Red-teaming LLM agents via poisoning memory or knowledge bases,” in Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems 2024, NeurIPS 2024, Vancouver, BC,...

    2024

  8. [16]

    Human- imperceptible retrieval poisoning attacks in llm-powered applications,

    Q. Zhang, B. Zeng, C. Zhou, G. Go, H. Shi, and Y . Jiang, “Human- imperceptible retrieval poisoning attacks in llm-powered applications,” in Companion Proceedings of the 32nd ACM International Conference on the Foundations of Software Engineering , ser. FSE 2024. New York, NY ...

    2024

  9. [17]

    An empirical study of artifacts and security risks in the pre-trained model supply chain,

    W. Jiang, N. Synovic, R. Sethi, A. Indarapu, M. Hyatt, T. R. Schorlemmer, G. K. Thiruvathukal, and J. C. Davis, “An empirical study of artifacts and security risks in the pre-trained model supply chain,” in Proceedings of the 2022 ACM Workshop on Software Supply Chain Offensiv...

    2022

  10. [18]

    An empirical study of pre-trained model reuse in the hugging face deep learning model registry,

    W. Jiang, N. Synovic, M. Hyatt, T. R. Schorlemmer, R. Sethi, Y .- H. Lu, G. K. Thiruvathukal, and J. C. Davis, “An empirical study of pre-trained model reuse in the hugging face deep learning model registry,” in 2023 IEEE/ACM 45th International Conference on Software Engineeri...

    2023

  11. [19]

    llama-index vulnerable to arbitrary code execution,

    Github, “llama-index vulnerable to arbitrary code execution,” https: //github.com/advisories/GHSA-2xxc-73fv-36f7, 2024, accessed: 2025- 04-23

    2024

  12. [20]

    transformers has a deserialization of untrusted data vulnerability,

    ——, “transformers has a deserialization of untrusted data vulnerability,” https://github.com/advisories/GHSA-3863-2447-669p, 2024, accessed: 2025-04-23

    2024

  13. [22]

    Characterizing deep learning package supply chains in pypi: Domains, clusters, and disengagement,

    K. Gao, R. He, B. Xie, and M. Zhou, “Characterizing deep learning package supply chains in pypi: Domains, clusters, and disengagement,” ACM Trans. Softw. Eng. Methodol. , vol. 33, no. 4, Apr. 2024. [Online]. Available: https://doi.org/10.1145/3640336

    2024 doi

  14. [23]

    tensorflow,

    tensorflow, “tensorflow,” https://github.com/tensorflow/tensorflow, 2025, accessed: 2025-04-23

    2025

  15. [24]

    pytorch,

    pytorch, “pytorch,” https://github.com/pytorch/pytorch, 2025, accessed: 2025-04-23

    2025

  16. [25]

    Towards understanding third-party library dependency in c/c++ ecosystem,

    W. Tang, Z. Xu, C. Liu, J. Wu, S. Yang, Y . Li, P. Luo, and Y . Liu, “Towards understanding third-party library dependency in c/c++ ecosystem,” in Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering , ser. ASE ’22. New York, NY , USA: As...

    2023

  17. [26]

    Demystifying the vulnerability propagation and its evolution via dependency trees in the npm ecosystem,

    C. Liu, S. Chen, L. Fan, B. Chen, Y . Liu, and X. Peng, “Demystifying the vulnerability propagation and its evolution via dependency trees in the npm ecosystem,” in Proceedings of the 44th International Conference on Software Engineering , ser. ICSE ’22. New York, NY , USA: As...

    2022

  18. [27]

    Understanding the threats of upstream vulnerabilities to downstream projects in the maven ecosystem,

    Y . Wu, Z. Yu, M. Wen, Q. Li, D. Zou, and H. Jin, “Understanding the threats of upstream vulnerabilities to downstream projects in the maven ecosystem,” in 2023 IEEE/ACM 45th International Conference on Software Engineering (ICSE) , 2023, pp. 1046–1058

    2023

  19. [28]

    A survey on large language model based autonomous agents,

    L. Wang, C. Ma, X. Feng, Z. Zhang, H. Yang, J. Zhang, Z. Chen, J. Tang, X. Chen, Y . Lin, W. X. Zhao, Z. Wei, and J. Wen, “A survey on large language model based autonomous agents,” Frontiers Comput. Sci. , vol. 18, no. 6, p. 186345, 2024. [Online]. Available: https://doi.org/...

    2024 doi

  20. [29]

    Large language model operations (llmops): Definition, challenges, and lifecycle management,

    J. Diaz-De-Arcaya, J. L ´opez-De-Armentia, R. Mi ˜n´on, I. L. Ojanguren, and A. I. Torre-Bastida, “Large language model operations (llmops): Definition, challenges, and lifecycle management,” in 2024 9th Inter- national Conference on Smart and Sustainable Technologies (SpliTec...

    2024

  21. [30]

    Large language models: A comprehensive survey of its applications, challenges, limitations, and future prospects,

    M. U. Hadi, Q. Al Tashi, R. Qureshi et al. , “Large language models: A comprehensive survey of its applications, challenges, limitations, and future prospects,” TechRxiv, February 2025. [Online]. Available: https://doi.org/10.36227/techrxiv.23589741.v8

    2025 doi

  22. [31]

    PyPI, “Pypi,” https://pypi.org/, 2025, accessed: 2025-04-23

    2025

  23. [32]

    Registry,

    NPM, “Registry,” https://github.com/npm/registry, 2025, accessed: 2025- 04-23

    2025

  24. [33]

    Deepseek-v3,

    deepseek ai, “Deepseek-v3,” https://github.com/deepseek-ai/ DeepSeek-V3, 2025, accessed: 2025-04-23

    2025

  25. [34]

    Cve list,

    MITRE, “Cve list,” https://cve.mitre.org/index.html, 2025, accessed: 2025-04-23

    2025

  26. [35]

    Github advisory database,

    Github, “Github advisory database,” https://github.com/advisories, 2025, accessed: 2025-04-23

    2025

  27. [36]

    The world’s first bug bounty platform for ai/ml,

    Huntr, “The world’s first bug bounty platform for ai/ml,” https://huntr. com/, 2025, accessed: 2025-04-23

    2025

  28. [38]

    Vision: Identifying affected library versions for open source software vulnerabilities,

    S. Wu, R. Wang, K. Huang, Y . Cao, W. Song, Z. Zhou, Y . Huang, B. Chen, and X. Peng, “Vision: Identifying affected library versions for open source software vulnerabilities,” in Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, ser. ...

    2024

  29. [39]

    On the effect of transitivity and granularity on vulnerability propagation in the maven ecosystem,

    A. M. Mir, M. Keshani, and S. Proksch, “On the effect of transitivity and granularity on vulnerability propagation in the maven ecosystem,” in 2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) , 2023, pp. 201–211

    2023

  30. [40]

    Mitigating persistence of open-source vulnerabilities in maven ecosystem,

    L. Zhang, C. Liu, S. Chen, Z. Xu, L. Fan, L. Zhao, Y . Zhang, and Y . Liu, “Mitigating persistence of open-source vulnerabilities in maven ecosystem,” in 2023 38th IEEE/ACM International Conference on Automated Software Engineering (ASE) , 2023, pp. 191–203

    2023

  31. [41]

    Decoding web3: In-depth analysis of the third-party package supply chain,

    K. Ma, Z. Wang, Y . Zhao, and H. Wang, “Decoding web3: In-depth analysis of the third-party package supply chain,” in Proceedings of the 15th Asia-Pacific Symposium on Internetware, Internetware 2024, Macau, SAR, China, July 24-26, 2024 , H. Mei, J. Lv, A. Helal, X. Ma, S. Che...

    2024

  32. [42]

    Peatmoss: A dataset and initial analysis of pre-trained models in open-source software,

    W. Jiang, J. Yasmin, J. Jones, N. Synovic, J. Kuo, N. Bielanski, Y . Tian, G. K. Thiruvathukal, and J. C. Davis, “Peatmoss: A dataset and initial analysis of pre-trained models in open-source software,” in Proceedings of the 21st International Conference on Mining Software Rep...

    2024

  33. [43]

    The ML supply chain in the era of software 2.0: Lessons learned from hugging face,

    T. Stalnaker, N. Wintersgill, O. Chaparro, L. A. Heymann, M. D. Penta, D. M. Germ ´an, and D. Poshyvanyk, “The ML supply chain in the era of software 2.0: Lessons learned from hugging face,” CoRR, vol. abs/2502.04484, 2025. [Online]. Available: https: //doi.org/10.48550/arXiv....

    2025 doi

  34. [44]

    Empirical analysis of security vulnerabilities in python packages,

    M. Alfadel, D. E. Costa, and E. Shihab, “Empirical analysis of security vulnerabilities in python packages,” Empir. Softw. Eng., vol. 28, no. 3, p. 59, 2023. [Online]. Available: https: //doi.org/10.1007/s10664-022-10278-4

    2023 doi

  35. [45]

    Demystifying dependency bugs in deep learning stack,

    K. Huang, B. Chen, S. Wu, J. Cao, L. Ma, and X. Peng, “Demystifying dependency bugs in deep learning stack,” in Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering , ser. ESEC/FSE 2023. New York, N...

    2023

  36. [46]

    A large-scale exploit instrumentation study of AI/ML supply chain attacks in hugging face models,

    B. Casey, J. C. S. Santos, and M. Mirakhorli, “A large-scale exploit instrumentation study of AI/ML supply chain attacks in hugging face models,” CoRR, vol. abs/2410.04490, 2024. [Online]. Available: https://doi.org/10.48550/arXiv.2410.04490

    2024 doi arXiv

  37. [2023]

    Available: https://doi.org/10.48550/arXiv.2308.08155

    [Online]. Available: https://doi.org/10.48550/arXiv.2308.08155

    doi arXiv

  38. [2024]

    Available: https://doi.org/10.1145/3597503.3639187

    [Online]. Available: https://doi.org/10.1145/3597503.3639187

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.