一句话：提出效应安全的包升级与效应感知包管理器，借助效应锁文件阻止供应链攻击。
当今软件大量依赖包，包生态成为供应链攻击的高价值目标，攻击者可劫持包注入恶意代码、窃取敏感信息或造成破坏。本文探索用效应系统对抗此类攻击。效应系统可预测软件组件行为，但语言中的效应系统与包生态之间缺乏实用桥梁。作者提出“效应安全包升级”概念，并设计效应感知包管理器，通过效应锁文件强制执行安全约束；该工作被集成到 Flix 语言及其编译器工具链。评估使用“Backstabbers Knife Collection”恶意软件语料中的 51 个供应链攻击案例，结果显示其中 48 个攻击可能被该包管理器阻止。
Today, most software is developed by building on packages, allowing developers to accelerate development. The proliferation of package dependencies creates a target-rich environment for malicious actors to hijack packages to inject malware, steal sensitive information, or cause destruction. Such supply chain attacks constantly threaten package ecosystems such as Cargo, npm, and Maven. In this paper, we explore how to fight against such attacks by leveraging effect systems. While effect systems predict the behavior of software components, there is a practical gap between a programming language with an effect system and a programming language ecosystem that can use such effects to thwart attacks. To close this gap, we introduce a notion of an effect-safe package upgrade and develop an effect-aware package manager that enforces safety through effect lock files. We extend the Flix programming language and its compiler toolchain with an effect-aware package manager. We evaluate the usefulness of the proposed effect-aware package manager with a case study of 51 supply chain attacks from the "Backstabbers Knife Collection" corpus of malware. The study suggests that 48 of these attacks are likely preventable with our proposed effect-aware package manager.
@article{paperbot12124,
title = {Fighting Supply Chain Attacks with Effect Systems},
author = {Magnus Madsen and Andreas Stenbæk Larsen and Jakob Schneider Villumsen and Aslan Askarov},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA2},
year = {2026},
doi = {10.1145/3839494}
}