With the growing popularity of modularity in software development comes the rise of
package managers and language ecosystems. Among them, npm stands out as the most …

Prototype pollution is a dangerous vulnerability affecting prototype-based languages like
JavaScript and the Node. js platform. It refers to the ability of an attacker to inject properties …

In recent years, we have seen an increased interest in studying the software supply chain of
user-facing applications to uncover problematic third-party dependencies. Prior work shows …

Taint-style vulnerabilities, such as OS command injection and path traversal, are common
and severe software weaknesses. There exists an inherent trade-off between analysis …

The npm software ecosystem allows developers to easily import code written by others.
However, manual vetting of every individual installed component is made difficult in many …

NPM is the largest software ecosystem in the world, offering millions of free, reusable
packages. In recent years, various security threats to packages published on npm have …

Software supply-chain attacks target components that are integrated into client applications.
Such attacks often target widely-used components, with the attack taking place via …

Deno is a runtime for JavaScript and TypeScript that is receiving great interest by
developers, and is increasingly used for the construction of back-ends of web applications. A …

Prototype pollution is a type of recently-discovered, impactful vulnerability that affects
JavaScript code. One important yet challenging research problem of prototype pollution is …

Packages in the Node. js ecosystem often suffer from serious vulnerabilities such as
arbitrary command injection and code execution. Existing taint analysis tools fall short in …