4 papers
X.js: A Live Benchmark for Node.js Taint-Style Vulnerabilities
José Afonso, João Madeira Pereira, Ronghao Ni +3
JavaScript vulnerabilities in npm packages pose a significant risk to the Nodejs ecosystem, and a growing body of work aims to detect, exploit, and mitigate them. Studying and e…
Correct Verdicts, Flawed Reasoning: Structured Auditing of LLM-based Vulnerability Reasoning
Boyue Caroline Hu, Kaivalya Ahir, Ronghao Ni +1
Large Language Models (LLMs) are increasingly deployed for automated software vulnerability analysis. Binary classification alone is insufficient; practitioners need explanations t…
Taint-Style Vulnerability Detection and Confirmation for Node.js Packages Using LLM Agent Reasoning
Ronghao Ni, Mihai Christodorescu, Limin Jia
The rapidly evolving Nodejs ecosystem currently includes millions of packages and is a critical part of modern software supply chains, making vulnerability detection of Nodej…
Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js
Ronghao Ni, Aidan Z. H. Yang, Min-Chien Hsu +5
Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts p…