Preprint reports 97% accuracy classifying software supply chain threats

Researchers report 97% accuracy and 97% macro F1 for a GPT-4 framework that classifies open-source software supply chain threats into five attack categories. Their preprint uses 999 verified incidents spanning 2018 to 2026 across eight package ecosystems. The framework structures prompts around a defined attack taxonomy. Comparisons included eight other methods; a simple TF-IDF classifier achieved 82.3%, exceeding the tested fine-tuned Llama and SecRoBERTa models. The researchers have made their dataset, scripts and code publicly available on GitHub. The evaluation concerns classification of documented incidents.