{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,12]],"date-time":"2026-09-12T02:29:04Z","timestamp":1789180144694,"version":"build-2803163510"},"publisher-location":"New York, NY, USA","reference-count":94,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,12,2]],"date-time":"2024-12-02T00:00:00Z","timestamp":1733097600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by-nc-sa\/4.0\/"}],"funder":[{"name":"Defense Advanced Research Projects Agency (DARPA)","award":["22AP0013700"],"award-info":[{"award-number":["22AP0013700"]}]},{"name":"National Science Foundation (NSF)","award":["CNS-21-54404 and CNS-20- 46361"],"award-info":[{"award-number":["CNS-21-54404 and CNS-20- 46361"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,12,2]]},"DOI":"10.1145\/3658644.3670331","type":"proceedings-article","created":{"date-parts":[[2024,12,9]],"date-time":"2024-12-09T12:19:20Z","timestamp":1733746760000},"page":"585-599","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["ReactAppScan: Mining React Application Vulnerabilities via Component Graph"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0003-1545-2376","authenticated-orcid":false,"given":"Zhiyong","family":"Guo","sequence":"first","affiliation":[{"name":"Johns Hopkins University, Baltimore, MD, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-9476-9247","authenticated-orcid":false,"given":"Mingqing","family":"Kang","sequence":"additional","affiliation":[{"name":"Johns Hopkins University, Baltimore, MD, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1690-9185","authenticated-orcid":false,"given":"V.N.","family":"Venkatakrishnan","sequence":"additional","affiliation":[{"name":"University of Illinois Chicago, Chicago, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-3715-077X","authenticated-orcid":false,"given":"Rigel","family":"Gjomemo","sequence":"additional","affiliation":[{"name":"University of Illinois Chicago, Chicago, IL, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9618-4830","authenticated-orcid":false,"given":"Yinzhi","family":"Cao","sequence":"additional","affiliation":[{"name":"Johns Hopkins University, Baltimore, MD, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,12,9]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2021. CVE-2021--23398 Detail. Retrieved Jan 6 2024 from https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021--23398"},{"key":"e_1_3_2_1_2_1","unstructured":"2021. CVE-2021--31712 Detail. Retrieved Jan 6 2024 from https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2021--31712"},{"key":"e_1_3_2_1_3_1","unstructured":"2022. JSX. Retrieved Dec 21 2023 from https:\/\/facebook.github.io\/jsx\/"},{"key":"e_1_3_2_1_4_1","unstructured":"2022. ODGen. Retrieved Nov 20 2023 from https:\/\/github.com\/Song-Li\/ODGen"},{"key":"e_1_3_2_1_5_1","volume-title":"Retrieved","year":"2023","unstructured":"2023. 2023 Developer Survey. Retrieved Jan 10, 2024 from https:\/\/survey.stackoverflow.co\/2023\/#section-most-popular-technologiesweb-frameworks-and-technologies"},{"key":"e_1_3_2_1_6_1","unstructured":"2023. CVE-2023--22462 Detail. Retrieved Jan 6 2024 from https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023--22462"},{"key":"e_1_3_2_1_7_1","unstructured":"2023. CVE-2023--34245 Detail. Retrieved Jan 6 2024 from https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023--34245"},{"key":"e_1_3_2_1_8_1","unstructured":"2023. CVE-2023--5654 Detail. Retrieved Jan 6 2024 from https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023--5654"},{"key":"e_1_3_2_1_9_1","volume-title":"Client-side cross-site scripting. Retrieved","year":"2024","unstructured":"2024. Client-side cross-site scripting. Retrieved Jan 5, 2024 from https:\/\/codeql.github.com\/codeql-query-help\/javascript\/js-xss\/"},{"key":"e_1_3_2_1_10_1","unstructured":"2024. CodeQL. Retrieved Jan 6 2024 from https:\/\/codeql.github.com\/"},{"key":"e_1_3_2_1_11_1","unstructured":"2024. Dangerously setting the inner HTML. https:\/\/react.dev\/reference\/reactdom\/components\/common#dangerously-setting-the-inner-html"},{"key":"e_1_3_2_1_12_1","unstructured":"2024. DOMPurify - a DOM-only super-fast uber-tolerant XSS sanitizer for HTML MathML and SVG. https:\/\/github.com\/cure53\/DOMPurify"},{"key":"e_1_3_2_1_13_1","unstructured":"2024. Espree. https:\/\/github.com\/eslint\/espree."},{"key":"e_1_3_2_1_14_1","volume-title":"Retrieved","author":"Node Express","year":"2024","unstructured":"2024. Express - Node.js web application framework. Retrieved Jan 19, 2024 from https:\/\/expressjs.com\/"},{"key":"e_1_3_2_1_15_1","unstructured":"2024. HTML 5. Retrieved Jan 19 2024 from https:\/\/www.w3.org\/TR\/2008\/WDhtml5--20080610\/dom.html#innerhtml0"},{"key":"e_1_3_2_1_16_1","unstructured":"2024. JSON Schema. https:\/\/json-schema.org\/"},{"key":"e_1_3_2_1_17_1","volume-title":"Retrieved","year":"2024","unstructured":"2024. JSX Prevents Injection Attacks. Retrieved Jan 10, 2024 from https:\/\/legacy.reactjs.org\/docs\/introducing-jsx.html#jsx-prevents-injection-attacks"},{"key":"e_1_3_2_1_18_1","volume-title":"lazy. Retrieved","year":"2024","unstructured":"2024. lazy. Retrieved Jan 6, 2024 from https:\/\/react.dev\/reference\/react\/lazy"},{"key":"e_1_3_2_1_19_1","unstructured":"2024. Managing State. https:\/\/react.dev\/learn\/managing-state"},{"key":"e_1_3_2_1_20_1","unstructured":"2024. markdown-it - Markdown parser done right. https:\/\/github.com\/markdown-it\/markdown-it\/tree\/master"},{"key":"e_1_3_2_1_21_1","volume-title":"Retrieved","year":"2024","unstructured":"2024. MongoDB: The Developer Data Platform. Retrieved Jan 19, 2024 from https:\/\/www.mongodb.com\/"},{"key":"e_1_3_2_1_22_1","unstructured":"2024. Mongoose: elegant mongodb object modeling for node.js. https:\/\/mongoosejs.com\/"},{"key":"e_1_3_2_1_23_1","volume-title":"National Vulnerability Database. Retrieved","year":"2024","unstructured":"2024. National Vulnerability Database. Retrieved Jan 5, 2024 from https:\/\/nvd.nist.gov\/"},{"key":"e_1_3_2_1_24_1","volume-title":"Retrieved","year":"2024","unstructured":"2024. Passing Props to a Component. Retrieved Jan 19, 2024 from https:\/\/react.dev\/learn\/passing-props-to-a-component"},{"key":"e_1_3_2_1_25_1","unstructured":"2024. React. Retrieved Jan 6 2024 from https:\/\/react.dev\/"},{"key":"e_1_3_2_1_26_1","unstructured":"2024. React Developer Tools. https:\/\/react.dev\/learn\/react-developer-tools"},{"key":"e_1_3_2_1_27_1","unstructured":"2024. ReactAppScan Open-Source Repository. https:\/\/github.com\/react-appscan\/react-app-scan"},{"key":"e_1_3_2_1_28_1","volume-title":"Reflected cross-site scripting. Retrieved","year":"2024","unstructured":"2024. Reflected cross-site scripting. Retrieved Jan 5, 2024 from https:\/\/codeql.github.com\/codeql-query-help\/javascript\/js-reflected-xss\/"},{"key":"e_1_3_2_1_29_1","unstructured":"2024. rjsf-team\/react-jsonschema-form. https:\/\/github.com\/rjsf-team\/reactjsonschema-form"},{"key":"e_1_3_2_1_30_1","unstructured":"2024. sanitize-html. https:\/\/www.npmjs.com\/package\/sanitize-html"},{"key":"e_1_3_2_1_31_1","volume-title":"Retrieved","year":"2024","unstructured":"2024. State: A Component's Memory. Retrieved Jan 19, 2024 from https:\/\/react.dev\/learn\/state-a-components-memory"},{"key":"e_1_3_2_1_32_1","volume-title":"Stored cross-site scripting. Retrieved","year":"2024","unstructured":"2024. Stored cross-site scripting. Retrieved Jan 5, 2024 from https:\/\/codeql.github.com\/codeql-query-help\/javascript\/js-stored-xss\/"},{"key":"e_1_3_2_1_33_1","unstructured":"2024. Taint Tracking of Function Passed Through JSX Attributes. https:\/\/github.com\/github\/codeql\/issues\/15207."},{"key":"e_1_3_2_1_34_1","volume-title":"Writing Markup with JSX. Retrieved","year":"2024","unstructured":"2024. Writing Markup with JSX. Retrieved Jan 6, 2024 from https:\/\/react.dev\/learn\/writing-markup-with-jsx\/"},{"key":"e_1_3_2_1_35_1","unstructured":"Olivier Arteau. 2018. Prototype pollution attack in nodejs application."},{"key":"e_1_3_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP.2017.14"},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635916"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00077"},{"key":"e_1_3_2_1_39_1","volume-title":"Finding and Preventing Bugs in JavaScript Bindings. In 2017 IEEE Symposium on Security and Privacy (SP). 559--578","author":"Brown Fraser","year":"2017","unstructured":"Fraser Brown, Shravan Narayan, Riad S. Wahby, Dawson Engler, Ranjit Jhala, and Deian Stefan. 2017. Finding and Preventing Bugs in JavaScript Bindings. In 2017 IEEE Symposium on Security and Privacy (SP). 559--578."},{"key":"e_1_3_2_1_40_1","volume-title":"Retrieved","year":"2024","unstructured":"BuiltWith. [n. d.]. React Usage Statistics. Retrieved Jan 18, 2024 from https:\/\/trends.builtwith.com\/javascript\/React"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2017.23152"},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/2664243.2664256"},{"key":"e_1_3_2_1_43_1","volume-title":"PathCutter: Severing the Self-Propagation Path of XSS JavaScript Worms in Social Web Networks. In Network and Distributed System Security Symposium.","author":"Cao Yinzhi","year":"2012","unstructured":"Yinzhi Cao, Vinod Yegneswaran, Phillip A. Porras, and Yan Chen. 2012. PathCutter: Severing the Self-Propagation Path of XSS JavaScript Worms in Social Web Networks. In Network and Distributed System Security Symposium."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/EuroSP57164.2023.00068"},{"key":"e_1_3_2_1_45_1","volume-title":"27th USENIX Security Symposium (USENIX Security 18)","author":"Davis James C","year":"2018","unstructured":"James C Davis, Eric R Williamson, and Dongyoon Lee. 2018. A Sense of Time for JavaScript and Node.js: First-Class Timeouts as a Cure for Event Handler Poisoning. In 27th USENIX Security Symposium (USENIX Security 18). 343--359."},{"key":"e_1_3_2_1_46_1","volume-title":"Ryan Elder, Brendan Saltaformaggio, and Wenke Lee.","author":"Duan Ruian","year":"2020","unstructured":"Ruian Duan, Omar Alrawi, Ranjita Pai Kasturi, Ryan Elder, Brendan Saltaformaggio, and Wenke Lee. 2020. Towards measuring supply chain attacks on package managers for interpreted languages. arXiv preprint arXiv:2002.01139 (2020)."},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40001.2021.00022"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3345656"},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3359789.3359813"},{"key":"e_1_3_2_1_50_1","doi-asserted-by":"crossref","unstructured":"Aurore Fass Robert P. Krawczyk Michael Backes and Ben Stock. 2018. JaSt: Fully Syntactic Detection of Malicious (Obfuscated) JavaScript. In Detection of Intrusions and Malware and Vulnerability Assessment Cristiano Giuffrida S\u00e9bastien Bardin and Gregory Blanc (Eds.). Cham 303--325.","DOI":"10.1007\/978-3-319-93411-2_14"},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484745"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/24039.24041"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.24846\/v28i2y201911"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.1145\/3178876.3186097"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00005"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.1145\/2025113.2025125"},{"key":"e_1_3_2_1_57_1","volume-title":"Static Analysis","author":"Jensen Simon Holm","unstructured":"Simon Holm Jensen, Anders M\u00f8ller, and Peter Thiemann. 2009. Type Analysis for JavaScript. In Static Analysis, Jens Palsberg and Zhendong Su (Eds.). Springer Berlin Heidelberg, Berlin, Heidelberg, 238--255."},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"crossref","unstructured":"Zihao Jin Shuo Chen Yang Chen Haixin Duan Jianjun Chen and Jianping Wu. 2023. A Security Study about Electron Applications and a Programming Methodology to Tame DOM Functionalities. In NDSS.","DOI":"10.14722\/ndss.2023.24305"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179352"},{"key":"e_1_3_2_1_60_1","volume-title":"Probe the Proto: Measuring Client-Side Prototype Pollution Vulnerabilities of One Million Real-world Websites. In Network and Distributed System Security Symposium (NDSS","author":"Kang Zifeng","year":"2022","unstructured":"Zifeng Kang, Song Li, and Yinzhi Cao. 2022. Probe the Proto: Measuring Client-Side Prototype Pollution Vulnerabilities of One Million Real-world Websites. In Network and Distributed System Security Symposium (NDSS 2022)."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/2635868.2635904"},{"key":"e_1_3_2_1_62_1","volume-title":"JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals. In 30th USENIX Security Symposium (USENIX Security 21)","author":"Khodayari Soheil","year":"2021","unstructured":"Soheil Khodayari and Giancarlo Pellegrino. 2021. JAW: Studying Client-side CSRF with Hybrid Property Graphs and Declarative Traversals. In 30th USENIX Security Symposium (USENIX Security 21). USENIX Association, 2525--2542. https:\/\/www.usenix.org\/conference\/usenixsecurity21\/presentation\/khodayari"},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-020-00537-0"},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10207-020-00537-0"},{"key":"e_1_3_2_1_65_1","volume-title":"23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID","author":"Koishybayev Igibek","year":"2020","unstructured":"Igibek Koishybayev and Alexandros Kapravelos. 2020. Mininode: Reducing the attack surface of Node.js applications. In 23rd International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2020). 121--134."},{"key":"e_1_3_2_1_66_1","volume-title":"FOOL 2012: 19th International Workshop on Foundations of Object-Oriented Languages. Citeseer, 96","author":"Lee Hongki","year":"2012","unstructured":"Hongki Lee, Sooncheol Won, Joonho Jin, Junhee Cho, and Sukyoung Ryu. 2012. SAFE: Formal specification and implementation of a scalable analysis framework for ECMAScript. In FOOL 2012: 19th International Workshop on Foundations of Object-Oriented Languages. Citeseer, 96."},{"key":"e_1_3_2_1_67_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516703"},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468542"},{"key":"e_1_3_2_1_69_1","volume-title":"31st USENIX Security Symposium (USENIX Security 22)","author":"Li Song","year":"2022","unstructured":"Song Li, Mingqing Kang, Jianwei Hou, and Yinzhi Cao. 2022. Mining Node.js Vulnerabilities via Object Dependence Graph and Query. In 31st USENIX Security Symposium (USENIX Security 22). Boston, MA, 143--160."},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/2814270.2814272"},{"key":"e_1_3_2_1_71_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2018.23309"},{"key":"e_1_3_2_1_72_1","volume-title":"NDSS","volume":"20","author":"Nadji Yacin","year":"2009","unstructured":"Yacin Nadji, Prateek Saxena, and Dawn Song. 2009. Document Structure Integrity: A Robust Basis for Cross-site Scripting Defense.. In NDSS, Vol. 20."},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338933"},{"key":"e_1_3_2_1_74_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2015.23163"},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978384"},{"key":"e_1_3_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180184"},{"key":"e_1_3_2_1_77_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3133959"},{"key":"e_1_3_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1145\/2491411.2491447"},{"key":"e_1_3_2_1_79_1","volume-title":"Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js. USENIX Security.","author":"Shcherbakov Mikhail","year":"2023","unstructured":"Mikhail Shcherbakov, Musard Balliu, and Cristian-Alexandru Staicu. 2023. Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js. USENIX Security."},{"key":"e_1_3_2_1_80_1","volume-title":"Freezing theWeb: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers. In 27th USENIX Security Symposium (USENIX Security 18)","author":"Staicu Cristian-Alexandru","year":"2018","unstructured":"Cristian-Alexandru Staicu and Michael Pradel. 2018. Freezing theWeb: A Study of ReDoS Vulnerabilities in JavaScript-based Web Servers. In 27th USENIX Security Symposium (USENIX Security 18). 361--376."},{"key":"e_1_3_2_1_81_1","doi-asserted-by":"crossref","unstructured":"Marius Steffens Christian Rossow Martin Johns and Ben Stock. 2019. Don't Trust The Locals: Investigating the Prevalence of Persistent Client-Side Cross-Site Scripting in the Wild. (2019).","DOI":"10.14722\/ndss.2019.23009"},{"key":"e_1_3_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484535"},{"key":"e_1_3_2_1_83_1","volume-title":"NDSS","volume":"2007","author":"Vogt Philipp","year":"2007","unstructured":"Philipp Vogt, Florian Nentwich, Nenad Jovanovic, Engin Kirda, Christopher Kruegel, and Giovanni Vigna. 2007. Cross site scripting prevention with dynamic data tainting and static analysis.. In NDSS, Vol. 2007. 12."},{"key":"e_1_3_2_1_84_1","volume-title":"Retrieved","year":"2024","unstructured":"W3Techs. [n. d.]. Historical trends in the usage statistics of React versions for websites. Retrieved Jan 10, 2024 from https:\/\/w3techs.com\/technologies\/history_details\/js-react"},{"key":"e_1_3_2_1_85_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00086"},{"key":"e_1_3_2_1_86_1","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Wu Shujiang","year":"2019","unstructured":"Shujiang Wu, Song Li, Yinzhi Cao, and Ningfei Wang. 2019. Rendered private: Making {GLSL} execution uniform to prevent {WebGL-based} browser fingerprinting. In 28th USENIX Security Symposium (USENIX Security 19). 1645--1660."},{"key":"e_1_3_2_1_87_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2023.24394"},{"key":"e_1_3_2_1_88_1","volume-title":"30th USENIX Security Symposium (USENIX Security 21)","author":"Xiao Feng","year":"2021","unstructured":"Feng Xiao, Jianwei Huang, Yichang Xiong, Guangliang Yang, Hong Hu, Guofei Gu, and Wenke Lee. 2021. Abusing hidden properties to attack the Node.js ecosystem. In 30th USENIX Security Symposium (USENIX Security 21). 2951--2968."},{"key":"e_1_3_2_1_89_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.44"},{"key":"e_1_3_2_1_90_1","doi-asserted-by":"publisher","DOI":"10.1145\/3576915.3616584"},{"key":"e_1_3_2_1_91_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409747"},{"key":"e_1_3_2_1_92_1","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468577"},{"key":"e_1_3_2_1_93_1","doi-asserted-by":"publisher","DOI":"10.1145\/1963405.1963517"},{"key":"e_1_3_2_1_94_1","volume-title":"28th USENIX Security Symposium (USENIX Security 19)","author":"Zimmermann Markus","year":"2019","unstructured":"Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small world with high risks: A study of security threats in the npm ecosystem. In 28th USENIX Security Symposium (USENIX Security 19). 995--1010."}],"event":{"name":"CCS '24: ACM SIGSAC Conference on Computer and Communications Security","location":"Salt Lake City UT USA","acronym":"CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3670331","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3658644.3670331","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,8,22]],"date-time":"2025-08-22T05:55:40Z","timestamp":1755842140000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3658644.3670331"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,12,2]]},"references-count":94,"alternative-id":["10.1145\/3658644.3670331","10.1145\/3658644"],"URL":"https:\/\/doi.org\/10.1145\/3658644.3670331","relation":{},"subject":[],"published":{"date-parts":[[2024,12,2]]},"assertion":[{"value":"2024-12-09","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}