一句话：揭示利用软件仓库可信度操纵搜索引擎结果、推广非法网站的新型攻击 RepSEO，并大规模检测出 380 万个滥用包。
本文揭示一种不同于传统恶意包的新型攻击向量 RepSEO：攻击者精心构造软件包以操纵搜索引擎结果，利用软件仓库的可信度推广非法网站。作者系统分析其地下生态，识别账户提供者、广告主和发布者等参与者，并开发检测工具，应用于 npm、Docker Hub 和 NuGet 十年大规模数据集，发现 3,801,682 个滥用包。研究还揭示供应链战术，包括自建邮件服务注册账号、重定向隐藏落地页和快速部署；并识别问卷类与恶意软件分发类广告主。作者向 npm、NuGet、Docker Hub 和 Google 报告，获得确认且仓库开始移除滥用包，并开源代码与数据。
Distinct from traditional malicious packages, this paper uncovers a novel attack vector named “blackhat Search Engine Optimization through REPositories (RepSEO)”. In this approach, attackers carefully craft packages to manipulate search engine results, exploiting the credibility of software repositories to promote illicit websites. Our research presents a systematic analysis of the underground ecosystem of RepSEO, identifying key players such as account providers, advertisers, and publishers. We developed an effective detection tool, applied to a ten-year large-scale dataset of npm, Docker Hub, and NuGet software repositories. This investigation led to the startling discovery of 3,801,682 abusive packages, highlighting the widespread nature of this attack. Our study also delves into the supply chain tactics of these attacks, revealing strategies like the use of self-hosted email services for account registration, redirection methods to obscure landing pages, and rapid deployment techniques by aggressive attackers. Additionally, we explore the profit motives behind these attacks, identifying two primary types of advertisers: survey-based advertisers and malware distribution advertisers. We reported npm, NuGet, and Docker Hub about the RepSEO packages and the related supply chain vulnerabilities of Google, and received their acknowledgments. Software repositories have started removing the abusive packages as of this paper's submission. We also opensource our code and data to facilitate future research.
DOI 原文 ·
@inproceedings{paperbot8838,
title = {Exposing the Hidden Layer: Software Repositories in the Service of Seo Manipulation},
author = {Mengying Wu and Geng Hong and Wuyuao Mai and Xinyi Wu and Lei Zhang and Yingyuan Pu and Huajun Chai and Lingyun Ying and Haixin Duan and Min Yang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00147}
}