5 papers
MalSkillBench: A Runtime-Verified Benchmark of Malicious Agent Skills
Wenbo Guo, Wei Zeng, Chengwei Liu +5
AI coding agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-language instructions, executable scr…
How Effective Are NPM Malicious Package Detectors? A Large-Scale Empirical Study
Wenbo Guo, Zhongwen Chen, Zhengzi Xu +7
The NPM ecosystem faces escalating threats from malicious packages that exploit its open publication model. While numerous detection tools have been proposed, they are evaluated on…
JC-Finder: Detecting Java Clone-based Third-Party Library by Class-level Tree Analysis
Lida Zhao, Chaofan Li, Yueming Wu +10
While reusing third-party libraries (TPL) facilitates software development, its chaotic management has brought great threats to software maintenance and the unauthorized use of sou…
Detecting Essence Code Clones via Information Theoretic Analysis
Lida Zhao, Shihan Dou, Yutao Hu +8
Code cloning, a widespread practice in software development, involves replicating code fragments to save time but often at the expense of software maintainability and quality. In t…
An Empirical Study of Vulnerability Detection using Federated Learning
Peiheng Zhou, Ming Hu, Xingrun Quan +6
Although Deep Learning (DL) methods becoming increasingly popular in vulnerability detection, their performance is seriously limited by insufficient training data. This is mainly b…