@misc{indiciaed071e74b242e,
  title = {Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks},
  author = {Hao He and Bogdan Vasilescu and Christian Kästner},
  year = {2025},
  doi = {10.1145/3715728},
  url = {https://arxiv.org/abs/2502.06662},
  note = {Source identifier: 2502.06662}
}