Paper accepted to IEEE S&P 2027

Our paper “The Illusion of Provenance: An Empirical Study of Package Attestation Across Software Ecosystems” has been accepted to the 48th IEEE Symposium on Security and Privacy (IEEE S&P 2027).

Authors: Sangkyoung Park, Jiyong Lee, and Hyunsoo Kwon.

The paper examines what package attestation actually establishes across software ecosystems, and finds that the guarantee behind a “verified provenance” indicator differs a great deal between registries.

Congratulations to Sangkyoung and Jiyong on their first top-tier paper.