[Dailydave] paper + data-set tracking supply-chain compromises worth a peek by Geer, Tozer et.al.