The npm registry is one of the pillars of the JavaScript and Type-Script ecosystems, hosting
over 1.7 million packages ranging from simple utility libraries to complex frameworks and …

Prototype pollution is a dangerous vulnerability affecting prototype-based languages like
JavaScript and the Node. js platform. It refers to the ability of an attacker to inject properties …

Most of the code in typical Node. js applications comes from third-party libraries that consist
of a large number of interdependent modules. Because of the dynamic features of …

Node. js is a popular non-browser JavaScript platform that provides useful but sometimes
also vulnerable packages. On one hand, prior works have proposed many program analysis …

The software product is a source of cyber-attacks that target organizations by using their
software supply chain as a distribution vector. As the reliance of software projects on open …

Configuration options allow users to customize application features according to the desired
requirements. While the code that corresponds to disabled features is never executed, it still …

The npm software ecosystem allows developers to easily import code written by others.
However, manual vetting of every individual installed component is made difficult in many …

In recent years, we have seen an increased interest in studying the software supply chain of
user-facing applications to uncover problematic third-party dependencies. Prior work shows …

Taint-style vulnerabilities, such as OS command injection and path traversal, are common
and severe software weaknesses. There exists an inherent trade-off between analysis …

NPM is the largest software ecosystem in the world, offering millions of free, reusable
packages. In recent years, various security threats to packages published on npm have …