5 papers
Uncovering Hidden Inclusions of Vulnerable Dependencies in Real-World Java Projects
Stefan Schott, Serena Elisa Ponta, Wolfram Fischer +2
Open-source software (OSS) dependencies are a dominant component of modern software code bases. Using proven and well-tested OSS components lets developers reduce development time…
SourceBroken: A large-scale analysis on the (un)reliability of SourceRank in the PyPI ecosystem
Biagio Montaruli, Serena Elisa Ponta, Luca Compagna +1
SourceRank is a scoring system made of 18 metrics that assess the popularity and quality of open-source packages. Despite being used in several recent studies, none has thoroughly…
One Detector Fits All: Robust and Adaptive Detection of Malicious Packages from PyPI to Enterprises
Biagio Montaruli, Luca Compagna, Serena Elisa Ponta +1
The rise of supply chain attacks via malicious Python packages demands robust detection solutions. Current approaches, however, overlook two critical challenges: robustness against…
A Soundness and Precision Benchmark for Java Debloating Tools
Jonas Klauke, Tom Ohlmer, Stefan Schott +3
Modern software development reuses code by importing libraries as dependencies. Software projects typically include an average of 36 dependencies, with 80% being transitive, meanin…
Bytecode-centric Detection of Known-to-be-vulnerable Dependencies in Java Projects
Stefan Schott, Serena Elisa Ponta, Wolfram Fischer +2
On average, 71% of the code in typical Java projects comes from open-source software (OSS) dependencies, making OSS dependencies the dominant component of modern software code base…