dataesr/scientific-paragraphs-categorization huggingface dataset:
Unfortunately b64decode function is widely used for benign purposes, and the tool will generate many false positive alerts as it has no way to distinguish benign from malicious usage without further analysis. To avoid being overwhelmed by false positives, the current PyPI security review called Malware Checks  [52]  scans only the installation script setup. py. Unfortunately, several known attacks  [27, 40]  had malicious code injected into different files. Hence, the review of only setup. py files is not enough. Example 3. The typosquatting package jeIlyfish  [27]  mimicked the popular package jellyfish (the first L is an I) to steal SSH and GPG keys  [8]. There are two injected files: setup. py, and jellyfish. py in the typosquatting package. The malicious code is stored in the jellyfish.
RQ1: LASTPYMILE TO IDENTIFY CODE INJECTION The upper part of Figure  3  shows the typical process of the security review process in package repositories (e. g. , PyPI) for identifying suspicious artifacts that might occur during the release of a software project. First, the code in the published artifact is undergoing code review and scanning by the PyPI Administrators by running security checks  [52]. Currently, they are using two checks SetupPatternCheck and PackageTurnoverCheck (see  Section 7). Depending on the automated tool used by the maintainers, this scanning could be done on the entire artifact for backdoor injection (e. g. , Bandit) or on its files (e. g. , Malware Checks  [52] ). Then the output of the scan is used to decide whether the artifact should be uploaded to the package repository.
The bottom part of Figure  3  shows how LastPyMile can augment the traditional security process. As a preliminary, LastPyMile looks for the GitHub URLs of a PyPI package in various places, including package metadata, PyPI, and package homepage. Table  3  shows the number of GitHub URLs we found. Most of the packages declare their GitHub repositories in the metadata available on PyPI. In Step 1, LastPyMile iterate all commits to compute all file hashes and collect line contents from a source code repository. To ensure that all the files and lines are collected, LastPyMile processes commits from all branches and tags in the GitHub repository. LastPyMile supports processing the GitHub repository in parallel so that multiple commits can be processed simultaneously. Besides, to avoid processing the same commits in different branches, LastPyMile maintains  Fs ← CheckoutFilesInCommit(c) 7: for each f ∈ Fs do 8: H ← H ∪ SHA256 (f ) 9: L ← L ∪ ReadFile(f ) 10: return Set of file hashes, lines: Hs , Ls a shared set of already processed commits for synchronizing the processing tasks.
DATA COLLECTION To select the sample of Python packages for our study, we start with the list of the top 4000 most downloaded packages  [46] , which is the established approach to study the Python ecosystem, adopted both in academia  [6]  and industry  [30]  and  [12]. We identify 3662 packages (>91% of the selected Python packages) that use GitHub to maintain their source code. Among these packages, 3336 are unique repositories (83%). For simplicity, here we focus only on packages that claim their source code is on GitHub. Table  7  shows the characteristics of the collected repositories. Three repositories contain only two commits 8 , while several repositories had tens of thousands of commits (e. g. , pip has 10 730 commits 9 ). As we aimed to have a tool to be runnable "as you wait"  [39] , we set a timeout period of five minutes for analyzing all artifacts of a given package.
As a result, the selected packages resulted in 109 062 artifacts. We had to exclude 15 810 artifacts (14%) belonging to 'surviving' packages with 8 For example, https://github. com/datamade/probableparsing 9 At the time of data collection After checking the differences between the number of different files and code lines between source and package repositories (Figure  4 ), we observed that 66 artifacts featured a huge number of changes (>1000 different files). We manually analyzed those artifacts and found that the explanation lies in 'developers moving stuff around' across repositories, making it close to impossible to identify source code repositories by automatic means. The example in Figure  2  requires one to actually read the documentation. Besides the robotframework-selenium2library in Example 1, we found that sas7bdat package first hosted its source code on GitHub but then was moved to BitBucket.
RQ2: DIFFERENCES BETWEEN SOURCE CODE AND PACKAGE REPOSITORIES To answer RQ2, first, we compared the code distributed in PyPI artifacts with the corresponding source code repositories. Figure  5  shows that 65% of artifacts and 22% of files present in PyPI have changes with respect to the source code repository. I. e. , they might have malicious code injected during the package release process. However, only 5. 8% of artifacts and 2. 6% of files have changes in Python files, while 59% of artifacts and 19% of files have changes in other files. These findings suggest that it might be promising to limit the process checking for malicious injections to those artifacts and files that have discrepancies, as the other artifacts cannot have malicious injections during the release process. In this paper, we focus on the changed Python files as they might be the target of attackers for injecting executable malicious commands.
RQ3: LASTPYMILE COMBINED WITH OTHER PACKAGE SCANNERS The combination of LastPyMile with existing security scanners is essential for two reasons: First, it allows to reuse mature detection techniques of FOSS and commercial security scan tools. Second, by doing so, developers and development organizations can use the very same tools in different stages of the security review process, which protects their investments into software licenses, the design and implementation of review workflows, and developer education. As shown in Figure  3 , PyPI Administrators can achieve the reuse by filtering either the input or the output of such security scanners. They can feed tools operating on single files (Malware Checks), modules, or procedures (Bandit Checks) with input containing phantom lines, which is expected to reduce both the number of findings and the tool's runtime.
Scanning tools performing the whole program or inter-procedural analyses continue to work on the package's entire code base. Still, their output can be filtered to only show findings in phantom lines. In this paper, we focus on input filtering and show the results of combining LastPyMile with two well-known malware checking tools that are broadly used in the PyPI ecosystem: • Warehouse Malware Checks  [52]  tool is used by PyPI to check the suspicious code lines in every package uploaded to PyPI. At the time of writing, the tool supports two checks: SetupPatternCheck 11  for performing regular-expression based checks of the content of setup. py files for suspicious patterns on package upload and PackageTu-rnoverCheck  12  for performing daily scans for suspicious behavior about package ownership.
After applying LastPyMile to the tool results after running them on the entire artifacts, we observe a significant reduction of the number of alerts for both tools. For example, Bandit tool produced only 12 alerts (out of 1044) after applying LastPyMile on the results of the urlib3-1. 21. 1 scan. Similarly, the number of alerts produced by Malware Checks on the setup-tools-36. 0. 1 reduced to 12 instead of 489. Looking at the outcome of the benign packages, Last-PyMile reduced the number of alerts to zero. Being applied to setup. py files only, Malware Checks tool generates a number of alerts manageable by humans. However, scanning of only setup. py files does not guarantee the artifact to be free from malicious code as the 99% of code is not checked. The number of alerts that both tools produce after scanning the entire artifacts (3249 and 2665 false alerts for Malware Checks and Bandit respectively) demonstrates that such analysis does not scale for an 'onupload' analysis by PyPI maintainers.
In contrast, LastPyMile shows an excellent potential to improve the scanning results. First, it makes the number of alerts after running a tool on the entire artifact comparable with the current number of alerts generated by the Malware Checks (currently used by PyPI). Second, we do not observe any alerts for benign artifacts, which allows us to easily distinguish benign and malicious artifacts in our manual validation of the alerts. When run on all malicious code packages available from the literature, we were able to preserve all malicious alerts and did not introduce false positives over the current scanning process. Those properties make LastPyMile a candidate for software vetting processes of government organizations or other OSS consumers with high-security requirements. The review effort is manageable, even though typical development projects have dozens of dependencies with more or less frequent release and patch cycles.
THREATS TO VALIDITY The validity of results reported in this paper is impacted by several choices made during tool and experiment design. We only consider repositories hosted on GitHub 15. However, there are no significant obstacles to cover other version control systems and extend the current implementation to other Git service providers (e. g. GitLab or Bitbucket) as long as they support code commits (e. g. , Apache Subversion). The current implementation focuses on the Python packages in PyPI, and Python files in particular. The extension to other Python ecosystems (e. g. , anaconda)  16  , and interpreted languages and other file types seem straight-forward (e. g. , Node. js/npm and Ruby/RubyGems). Yet, we only considered the top 4000 packages hosted on PyPI, out of more than 250 000 packages.
Other phantom files might be also be used to inject malware. For example, the phantom files under the test directories are required by a popular testing framework like pytest. Another source of phantom files is the upload of modules specific to a developer development environment. They are usually not versioned with Git. Example 6. The phantom files in pydruid-0. 5. 4. tar. gz are the manually built Python packages stored in the sitepackages directory. We can verify the origin of the local installed modules by comparing their code files with the correponding GitHub repository. By using LastPyMile, we can check that the code files in the local module called traitlets (e. g. , https:// github. com/ ipython/ traitlets) of the artifact pydruid-0. 5. 4. tar. gz belonging to the correponding Github repository.
18 oreover, PyPI packages contain other executables, e. g. , Windows portable executables, OSX disk image files, or C/C++ static libraries. For example, we found many Python bytecode files (ending with. pyc). These files should not be uploaded to PyPI as this can make the dependent package (e. g. , a Debian package) fail to compile. 19 Investigating these cases would require a distinct paper. We only check additions of code lines in the present version, even though a vulnerability could be introduced by deleting lines from a software artifact (e. g. , by removing a sanitizing statement). Albeit LastPyMile does not report the deleted lines in such a case, it could detect that the files in the uploaded artifacts are different as their hashes would differ if compared to the hashes of the files stored in the corresponding source code repository.
RELATED WORK Zimmermann et al. [55]  study security risks for users of npm, including potential vulnerable and malicious code in thirdparty dependencies. The authors showed that npm suffers from single points of failure in which individual packages could impact large parts of the entire ecosystem. Attackers could compromise a minimal number of maintainers' accounts to inject malicious code into most packages. The paper, however, does not investigate the potentially malicious code injection in the package artifacts. Our LastPyMile approach provides a way to audit the popular packages by identifying the delta in the code that developers consume and the original code developed by vendors in their source code repository. Ohm et al. [33]  presents a taxonomy of attack vectors and a dataset of malicious software packages used in realworld attacks on open-source software supply chains on three package repositories npm, PyPI, and RubyGems.
This work highlights that typosquatting and infection of an existing package are the two most common attacks. This work, however, does not investigate the presence of code injections in legitimate and malicious packages. Our approach involves developing a method to identify the discrepancies between distributed artifacts and source code repositories that could be attributed to the malicious code injection. Several works (  [44, 50] ) study the potential impact of typosquatting attacks on PyPI packages based on the Levenshtein distance and number of downloads of the targeted package. They show a large number of typosquatting candidates in PyPI that PyPI Administrators should investigate. However, relying only on package names may cause many false positives, and a more in-depth analysis of distributed artifacts is required.
Garrett et al. [14, 16]  use an anomaly detection based approach on features extracted from packages' metadata and source code to detect suspicious package updates in npm. The method could reduce the review effort by 89%. However, the approach cannot highlight the code injections with the existing features as it analyzes only the published artifacts. Our LastPyMile can highlight the code injections and can be adapted to provide explanations to developers. Gonzalez et al. [17]  uses commit logs and repository metadata to detect potential malicious commits automatically. The method identifies 53. 3% of malicious commits while flagging less than 1% of commits in the studied dataset. Our LastPyMile instead looks for the code injections into the source code repositories by considering both the packages and source code repositories.
CONCLUSION We investigated the discrepancies between published artifacts and source code repositories to understand the risk of malicious injections during the software release process. Our empirical analysis of 2438 most downloaded PyPI packages shows that there exist differences between packages in PyPI and the corresponding source code repositories at different levels of granularity (artifacts, files, and lines). The differences are attributed to developers and automated tools (e. g. , packaging tools), and could impact the consumers, e. g. , causing compilation issues or representing a potential for containing malicious code injections. The flexible combination of LastPyMile (as input/output filter) with other security tools offers the possibility to reduce the number of findings and the time required by vetting processes.
We instructed Malware Checks and Bandit to only consider phantom code as input, and the resulting decrease in false alerts makes it possible to use LastPyMile as an additional check in the PyPI vetting processes with minimal impact on review efforts. A replication package is available at  [51]  and we plan to submit LastPyMile as a new check to PyPI. 20 everal issues still remain: malicious code can be hidden in many other forms, such as webpages (HTML with embedded or external JavaScript) or project configuration files (requirements. txt with a malicious dependency). We notice a high number of requirements. txt configuration files, which contain the list of dependencies to be installed automatically with pip install. This could be a potential vector for adversaries to add malicious injections worth further investigations.
ACKNOWLEDGMENTS We are grateful to  Michael Salsone ,  Lukas Martini  for sharing with us the malicious examples, and the anonymous reviewers for their insightful and actionable suggestions. This research has been partly funded by the  EU H2020  Programs  H2020-EU. 2. 1. 1-CyberSec4Europe (Grant No. 830929 ),  AssureMoss  (Grant No. 952647 ) and  SPARTA  project (Grant No. 830892 ).
S3a ). An average of 1735, 1690, and 1725 proteins were identified in C10, RAW, and SVEC cells, respectively (Fig. 3e ). Similar trends were also observed in the distribution of protein intensities (Fig. S3b ). Cheung and coworkers  17  recently introduced the software SCPCompanion to characterize the quality of the data generated from single-cell proteomics experiments employing isobaric stable isotope labels and a carrier proteome. SCPCompanion extracts signal-to-noise ratio (SNR) of single-cell channels and provides suggested cutoff values to filter out low-quality spectra to obtain high-quality protein quantitation. In line with our  experimental design, SCPCompanion estimated that ~0. 1 ng proteins were contained in single cells, and the boost-to-single ratio is ~100 (Supplementary Data 1), indicating minimal peptide losses in the N2 chip.
We assessed if we can use our scProteomics data to identify cell-type-specific membrane surface proteins for the three cell populations. We matched the enriched protein lists to a subcellular-localization database from Uni-ProtKB, which consists of 2871 reviewed plasma membrane proteins for Mus musculus (updated on 01/04/2021). We generated a list containing 64 plasma membrane proteins (Supplementary Data 2). Among them, 17 proteins were highly expressed in C10 compared to RAW and SVEC cells, while 34 and 13 plasma membrane proteins were significantly enriched in RAW and SVEC cells, respectively. For example, NCAM1  28  , EZRI  29  , and JAM1  30  , which are previously known to protect the barrier function of respiratory epithelial cells by enhancing the cell-cell adhesion, are highly expressed C10 cells (Fig.
Comparing scProteomics with scRNA-seq measurements. We compared the scProteomics results to previously published scRNA-seq datasets containing 11 C10 cells  37  and 185 Raw cells  38  generated with SMART-Seq2 workflows. Compared with scRNAseq, we observed higher Pearson correlation coefficients from scProteomics for both cell types (Fig. 6a ). Specifically, the medians of correlation coefficients of mRNA abundances are 0. 60 (C10) and 0. 71 (RAW), while the coefficients of protein abundances significantly increased to 0. 98 (C10) and 0. 97 (RAW). The low variation in protein abundances can also be observed in the CV distributions of protein or mRNA abundances (Fig. 6b ). Previous work have suggested moderate correlations between protein and mRNA abundances of the same genes  39, 40. Our cross-correlation analysis between protein and mRNA shows similar trends with coefficients of 0.
22 for C10 and 0. 36 for RAW (Fig. 6c, d ). These low correlations agree with bulk-scale measurement  41  and suggest scProteomics could provide additional information on the cell functions. To identify the differentially expressed proteins and mRNAs between the two cell types, we performed t-test for both datasets. The proteins and mRNAs enriched either in C10 or RAW were moderately correlated. The overlaps between enriched mRNA and proteins were 44% for C10 and 40% for RAW cells (Fig. S10a ). Most proteins and mRNAs followed a similar abundance pattern between the two cell types (Fig. 6e ). The linear correlation coefficient of the log2(fold-changes) of the protein-mRNA pair is 0. 55. The magnitude of the fold-change seemed higher for mRNA compared to protein (linear regression slope 0. 08).
However, several immune-related Reactome pathway terms were unique at mRNA level. Finally, we assessed if mRNA and protein measurements predict the same membrane protein markers. After matching to the same subcellular-localization database, scRNA-seq measurements identified 30 membrane proteins for RAW cells and 40 proteins for C10 cells (Supplementary Data 2). The overlaps between the two measurements were moderate for both cell types (Fig. 6f ). Less than 32. 5% protein targets predicted by RNA-seq were found by proteomics measurements, indicating mRNA abundances cannot precisely infer membrane protein abundances. Interestingly, both protein and mRNA measurements identified the six proteins shown in Fig. 5  as significantly enriched markers. Overall, our analysis suggests the combination of the two modalities provides the most reliable membrane protein markers.
A parallel droplet dispensing system could be developed for ultra-high throughput single-cell preparation. To further improve sample recovery and digestion efficiency, the nanowell diameters can be reduced to 0. 2 mm or below, which corresponds to total droplet volumes of <5 nL. New microfluidic strategies could be developed to minimize droplet evaporation and increase droplet dispensing precision  43. The proteome coverages could be improved with lower-flow LC systems  13, 44  , advanced MS instrumentation  23, 40  , and data analysis strategies  45. Using a recently-developed software, SCPCompanion  17  , we observed single-cell SNRs were greatly improved with N2 chipbased scProteomics workflow. Importantly, we observed high Pearson's correlation coefficient and low protein variations (median CVs of ~16.
3%) in single cells, suggesting not only that the method is highly reproducible but also a low heterogeneity in cells cultured in favorable and identical conditions (e. g. , nutrient-rich media without perturbation). These observations suggest cultured cells are good models to evaluate and benchmark the quantitative performance of scProteomics technologies. Using three distinct cell lines, we verified that the scProteomics allowed to robustly classify cells based on their protein abundances and reveal functional differences between them. We also demonstrated the scProteomics allowed to directly identify cell surface markers by leveraging established subcellular-localization databases. The direct comparison of our scProteomics with publicly available scRNA-seq datasets indicated that the amplitude of the variations observed in scProteomics was lower than those measured in transcriptomics.
The reason for these discrepancies remains unclear as it may be real or the result of technical artifacts  42. The integrative analysis showed moderate correlations between protein and transcript abundances, indicating scProteomics can provide a complementary perspective on cellular states. It should be noted that all the single-cell isolation and sample preparation were performed using a commercially available system (cellenONE). The microchip fabrication can be readily implemented in a typical cleanroom facility. Thus, we believe our N2 chip-based scProteomics workflow and related devices can be rapidly disseminated through a commercialization agreement. We believe that the N2 chip scProteomics platform presented herein will enable the scientific community to study cell differentiation, tumor heterogeneity, and to identify rare cell populations from clinical specimens.
Database searching. All the raw files from the Thermo MS were processed by MaxQuant 48 (Ver. 1. 6. 14. 0) with the UniProtKB protein sequence database of Mus musculus species (downloaded on 05/19/2020 containing 17,037 reviewed protein sequences). Reporter ion MS2 was set as the search type and TMT channel correction factors from the vendor were applied. The mass tolerances for precursor ions and fragment ions were set as 4. 5 ppm and 20 ppm, respectively in MaxQuant. Specific digestion enzymes were set as Trypsin and LysC. The number of allowed missed cleavages was set as 2. The match tolerance, de novo tolerance, and deisotoping tolerance for MS/MS search were 20, 10, and 7 ppm, respectively. The minimum peptide length was six amino acids and the maximum peptide mass was 4600 Da. Protein acetylation in N-terminal and oxidation at methionine were chosen as variable modifications, and protein carbamidomethylation in cysteine residues was set as fixed modification.