{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,7]],"date-time":"2026-09-07T12:25:07Z","timestamp":1788783907375,"version":"build-2803163510"},"publisher-location":"New York, NY, USA","reference-count":33,"publisher":"ACM","license":[{"start":{"date-parts":[[2026,6,1]],"date-time":"2026-06-01T00:00:00Z","timestamp":1780272000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2026,6]]},"DOI":"10.1145\/3779208.3785388","type":"proceedings-article","created":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T15:21:58Z","timestamp":1780586518000},"page":"1213-1227","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":1,"title":["Original Sin of npm: A Study on Vulnerability Propagation in JavaScript Dependency Networks"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-6835-0603","authenticated-orcid":false,"given":"Michael","family":"Robinson","sequence":"first","affiliation":[{"name":"Data61, CSIRO, Australia, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0965-6255","authenticated-orcid":false,"given":"Sajal","family":"Halder","sequence":"additional","affiliation":[{"name":"RMIT University and Data61, CSIRO, Australia, Melbourne, Victoria, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-8033-0998","authenticated-orcid":false,"given":"Muhammad Ejaz","family":"Ahmed","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Australia, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2113-3390","authenticated-orcid":false,"given":"Muhammad","family":"Ikram","sequence":"additional","affiliation":[{"name":"Macquarie University, Australia, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6353-8359","authenticated-orcid":false,"given":"Seyit","family":"Camtepe","sequence":"additional","affiliation":[{"name":"Data61, CSIRO, Australia, Sydney, NSW, Australia"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1605-3866","authenticated-orcid":false,"given":"Hyoungshick","family":"Kim","sequence":"additional","affiliation":[{"name":"Sungkyunkwan University, South Korea, Suwon, Gyeonggi-dou, Republic of Korea"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,6,4]]},"reference":[{"key":"e_1_3_2_1_1_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10278-4"},{"key":"e_1_3_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4614-6596-6_9"},{"key":"e_1_3_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2950325"},{"key":"e_1_3_2_1_4_1","volume-title":"IEEE security & privacy 12, 4","author":"Carvalho Marco","year":"2014","unstructured":"Marco Carvalho, Jared DeMott, Richard Ford, and David A Wheeler. 2014. Heartbleed 101. IEEE security & privacy 12, 4 (2014), 63\u201367."},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.140"},{"key":"e_1_3_2_1_6_1","unstructured":"CVE. [n.d.]. CVE Program. https:\/\/www.cve.org\/About\/Overview"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2018.00050"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196398.3196401"},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9589-y"},{"key":"e_1_3_2_1_10_1","unstructured":"FiRST. [n.d.]. Common Vulnerability Scoring System Version 4.0. https:\/\/www.first.org\/cvss\/v4- 0\/"},{"key":"e_1_3_2_1_11_1","unstructured":"FIRST. [n.d.]. FIRST Vision and Mission Statement. https:\/\/www.first.org\/about\/mission"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-023-10408-6"},{"key":"e_1_3_2_1_13_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2020.110653"},{"key":"e_1_3_2_1_14_1","unstructured":"Google. [n.d.]. Open Source Vulnerabilities. https:\/\/google.github.io\/osv.dev\/api\/"},{"key":"e_1_3_2_1_15_1","volume-title":"The race to the vulnerable: Measuring the log4j shell incident. arXiv preprint arXiv:2205.02544","author":"Hiesgen Raphael","year":"2022","unstructured":"Raphael Hiesgen, Marcin Nawrocki, Thomas C Schmidt, and Matthias W\u00e4hlisch. 2022. The race to the vulnerable: Measuring the log4j shell incident. arXiv preprint arXiv:2205.02544 (2022)."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"crossref","unstructured":"Manuel Hoffman Frank Nagle and Yanuo Zhou. 2024. The Value of Open Source Software. In Harvard Business School Strategy Unit Working Paper No. 24\u2013038.","DOI":"10.2139\/ssrn.4693148"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3380466"},{"key":"e_1_3_2_1_18_1","unstructured":"Open Source Insights. [n.d.]. deps.dev API. https:\/\/docs.deps.dev\/api\/v3\/"},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2017.55"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510142"},{"key":"e_1_3_2_1_21_1","unstructured":"npm. [n.d.]. Reporting malware in an npm package. https:\/\/docs.npmjs.com\/reporting-malware-in-an-npm-package"},{"key":"e_1_3_2_1_22_1","unstructured":"NVD. [n.d.]. General Information. https:\/\/nvd.nist.gov\/general"},{"key":"e_1_3_2_1_23_1","unstructured":"NVD. [n.d.]. Vulnerability Metrics. https:\/\/nvd.nist.gov\/vuln-metrics\/cvss"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3613094"},{"key":"e_1_3_2_1_25_1","unstructured":"Sonatype. [n.d.]. 2024 State of the Software Supply Chain. https:\/\/www.sonatype.com\/state-of-the-software-supply-chain\/Introduction"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2020.3044475"},{"key":"e_1_3_2_1_27_1","unstructured":"GitHub Staff. 2024. Octoverse 2024: The state of open source."},{"key":"e_1_3_2_1_28_1","unstructured":"Synopsys. [n.d.]. 2024 Open Source Security and Risk Analysis Report. https:\/\/www.synopsys.com\/softtware-integrity\/resources\/analyst-reports\/open-source-security-risk-analysis.html"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/2901739.2901743"},{"key":"e_1_3_2_1_30_1","volume-title":"32nd USENIX Security Symposium (USENIX Security 23)","author":"Woo Seunghoon","year":"2023","unstructured":"Seunghoon Woo, Eunjin Choi, Heejo Lee, and Hakjoo Oh. 2023. {V1SCAN}: Discovering 1-day Vulnerabilities in Reused {C\/C++} Open-source Software Components Using Code Classification Techniques. In 32nd USENIX Security Symposium (USENIX Security 23). 6541\u20136556."},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-90421-4_6"},{"key":"e_1_3_2_1_32_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10154-1"},{"key":"e_1_3_2_1_33_1","volume-title":"28th USENIX Security symposium (USENIX security 19)","author":"Zimmermann Markus","year":"2019","unstructured":"Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small world with high risks: A study of security threats in the npm ecosystem. In 28th USENIX Security symposium (USENIX security 19). 995\u20131010."}],"event":{"name":"ASIA CCS '26: ACM Asia Conference on Computer and Communications Security","location":"Bangalore India","acronym":"ASIA CCS '26","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the ACM Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3779208.3785388","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,6,4]],"date-time":"2026-06-04T15:30:14Z","timestamp":1780587014000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3779208.3785388"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,6]]},"references-count":33,"alternative-id":["10.1145\/3779208.3785388","10.1145\/3779208"],"URL":"https:\/\/doi.org\/10.1145\/3779208.3785388","relation":{},"subject":[],"published":{"date-parts":[[2026,6]]},"assertion":[{"value":"2026-06-04","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}