100 citations · 243 across the 16 of their papers we have counts for
18 papers
Uncovering Hidden Inclusions of Vulnerable Dependencies in Real-World Java Projects
Stefan Schott, Serena Elisa Ponta, Wolfram Fischer +2
Open-source software (OSS) dependencies are a dominant component of modern software code bases. Using proven and well-tested OSS components lets developers reduce development time…
SourceBroken: A large-scale analysis on the (un)reliability of SourceRank in the PyPI ecosystem
Biagio Montaruli, Serena Elisa Ponta, Luca Compagna +1
SourceRank is a scoring system made of 18 metrics that assess the popularity and quality of open-source packages. Despite being used in several recent studies, none has thoroughly…
One Detector Fits All: Robust and Adaptive Detection of Malicious Packages from PyPI to Enterprises
Biagio Montaruli, Luca Compagna, Serena Elisa Ponta +1
The rise of supply chain attacks via malicious Python packages demands robust detection solutions. Current approaches, however, overlook two critical challenges: robustness against…
A Soundness and Precision Benchmark for Java Debloating Tools
Jonas Klauke, Tom Ohlmer, Stefan Schott +3
Modern software development reuses code by importing libraries as dependencies. Software projects typically include an average of 36 dependencies, with 80% being transitive, meanin…
Bytecode-centric Detection of Known-to-be-vulnerable Dependencies in Java Projects
Stefan Schott, Serena Elisa Ponta, Wolfram Fischer +2
On average, 71% of the code in typical Java projects comes from open-source software (OSS) dependencies, making OSS dependencies the dominant component of modern software code base…
Compilation of Commit Changes within Java Source Code Repositories
Stefan Schott, Wolfram Fischer, Serena Elisa Ponta +2
Java applications include third-party dependencies as bytecode. To keep these applications secure, researchers have proposed tools to re-identify dependencies that contain known vu…
On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI
Piergiorgio Ladisa, Serena Elisa Ponta, Nicola Ronzoni +2
Current software supply chains heavily rely on open-source packages hosted in public repositories. Given the popularity of ecosystems like npm and PyPI, malicious users started to…
The Hitchhiker's Guide to Malicious Third-Party Dependencies
Piergiorgio Ladisa, Merve Sahin, Serena Elisa Ponta +3
The increasing popularity of certain programming languages has spurred the creation of ecosystem-specific package repositories and package managers. Such repositories (e.g., npm, P…
Journey to the Center of Software Supply Chain Attacks
Piergiorgio Ladisa, Serena Elisa Ponta, Antonino Sabetta +2
This work discusses open-source software supply chain attacks and proposes a general taxonomy describing how attackers conduct them. We then provide a list of safeguards to mitigat…
Towards the Detection of Malicious Java Packages
Piergiorgio Ladisa, Henrik Plate, Matias Martinez +2
Open-source software supply chain attacks aim at infecting downstream users by poisoning open-source packages. The common way of consuming such artifacts is through package reposit…
The Used, the Bloated, and the Vulnerable: Reducing the Attack Surface of an Industrial Application
Serena Elisa Ponta, Wolfram Fischer, Henrik Plate +1
Software reuse may result in software bloat when significant portions of application dependencies are effectively unused. Several tools exist to remove unused (byte)code from an ap…
Code-based Vulnerability Detection in Node.js Applications: How far are we?
Bodin Chinthanet, Serena Elisa Ponta, Henrik Plate +4
With one of the largest available collection of reusable packages, the JavaScript runtime environment Node.js is one of the most popular programming application. With recent work s…
A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software
Serena E. Ponta, Henrik Plate, Antonino Sabetta +2
Advancing our understanding of software vulnerabilities, automating their identification, the analysis of their impact, and ultimately their mitigation is necessary to enable the d…
Vulnerable Open Source Dependencies: Counting Those That Matter
Ivan Pashchenko, Henrik Plate, Serena Elisa Ponta +2
BACKGROUND: Vulnerable dependencies are a known problem in today's open-source software ecosystems because OSS libraries are highly interconnected and developers do not always upda…
Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software
Serena E. Ponta, Henrik Plate, Antonino Sabetta
The use of open-source software (OSS) is ever-increasing, and so is the number of open-source vulnerabilities being discovered and publicly disclosed. The gains obtained from the r…
Modularity for Security-Sensitive Workflows
Daniel Ricardo dos Santos, Silvio Ranise, Serena Elisa Ponta
An established trend in software engineering insists on using components (sometimes also called services or packages) to encapsulate a set of related functionalities or data. By de…
Impact assessment for vulnerabilities in open-source software libraries
Henrik Plate, Serena Elisa Ponta, Antonino Sabetta
Software applications integrate more and more open-source software (OSS) to benefit from code reuse. As a drawback, each vulnerability discovered in bundled OSS potentially affects…
Detection of Configuration Vulnerabilities in Distributed (Web) Environments
Matteo Maria Casalino, Michele Mangili, Henrik Plate +1
Many tools and libraries are readily available to build and operate distributed Web applications. While the setup of operational environments is comparatively easy, practice shows…