Imagen de Portada

What's in a Package? Getting Visibility Into Dependencies Using Security-Sensitive API Calls

Fuente: arXiv

Guardado en:

Detalles Bibliográficos
Autores principales:	Rahman, Imranur, Paramitha, Ranidya, Plate, Henrik, Wermke, Dominik, Williams, Laurie
Formato:	Preprint
Publicado:	2024
Materias:	Cryptography and Security Software Engineering
Acceso en línea:	Acceder al recurso
Etiquetas:	Agregar Etiqueta Sin Etiquetas, Sea el primero en etiquetar este registro!

Ejemplares similares

How Quickly Do Development Teams Update Their Vulnerable Dependencies?
por: Rahman, Imranur, et al.
Publicado: (2024)

Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software
por: Ponta, Serena E., et al.
Publicado: (2018)

Impact assessment for vulnerabilities in open-source software libraries
por: Plate, Henrik, et al.
Publicado: (2015)

Generating API Parameter Security Rules with LLM for API Misuse Detection
por: Liu, Jinghua, et al.
Publicado: (2024)

From Struggle to Simplicity with a Usable and Secure API for Encryption in Java
por: Firouzi, Ehsan, et al.
Publicado: (2024)

Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools in a Large Java-based System
por: Seth, Aishwarya, et al.
Publicado: (2023)

Toward Automated Security Risk Detection in Large Software Using Call Graph Analysis
por: Pecka, Nicholas, et al.
Publicado: (2025)

GraphQLer: Enhancing GraphQL Security with Context-Aware API Testing
por: Tsai, Omar, et al.
Publicado: (2025)

An Empirical Study of Vulnerable Package Dependencies in LLM Repositories
por: Liu, Shuhan, et al.
Publicado: (2025)

Securing the Software Package Supply Chain for Critical Systems
por: Murali, Ritwik, et al.
Publicado: (2025)

R+R: Reassessing Java Security API Misuse in Current LLMs: A Replication on JCA and JSSE APIs with External Security Knowledge
por: Lu, Tianhe, et al.
Publicado: (2026)

S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit
por: Rahman, Imranur, et al.
Publicado: (2025)

The Popularity Hypothesis in Software Security: A Large-Scale Replication with PHP Packages
por: Ruohonen, Jukka, et al.
Publicado: (2025)

Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web
por: Swierzy, Ben, et al.
Publicado: (2025)

A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software
por: Ponta, Serena E., et al.
Publicado: (2019)

Mind the Gap: Evaluating LLMs for High-Level Malicious Package Detection vs. Fine-Grained Indicator Identification
por: Ryan, Ahmed, et al.
Publicado: (2026)

RiskHarvester: A Risk-based Tool to Prioritize Secret Removal Efforts in Software Artifacts
por: Basak, Setu Kumar, et al.
Publicado: (2025)

Trusting code in the wild: Exploring contributor reputation measures to review dependencies in the Rust ecosystem
por: Hamer, Sivana, et al.
Publicado: (2024)

Mutation-based Evaluation of Cryptographic API Misuse Detectors
por: Ami, Amit Seal, et al.
Publicado: (2021)

Classport: Designing Runtime Dependency Introspection for Java
por: Cofano, Serena, et al.
Publicado: (2025)

Your ATs to Ts: MITRE ATT&CK Attack Technique to P-SSCRM Task Mapping
por: Hamer, Sivana, et al.
Publicado: (2025)

Software Supply Chain Smells: Lightweight Analysis for Secure Dependency Management
por: Schmid, Larissa, et al.
Publicado: (2026)

Using AI Assistants in Software Development: A Qualitative Study on Security Practices and Concerns
por: Klemmer, Jan H., et al.
Publicado: (2024)

When Specifications Meet Reality: Uncovering API Inconsistencies in Ethereum Infrastructure
por: Ma, Jie, et al.
Publicado: (2026)

ConfuGuard: Using Metadata to Detect Active and Stealthy Package Confusion Attacks Accurately and at Scale
por: Jiang, Wenxin, et al.
Publicado: (2025)

Enhancing REST API Fuzzing with Access Policy Violation Checks and Injection Attacks
por: Sahin, Omur, et al.
Publicado: (2026)

Closing the Chain: How to reduce your risk of being SolarWinds, Log4j, or XZ Utils
por: Hamer, Sivana, et al.
Publicado: (2025)

AssetHarvester: A Static Analysis Tool for Detecting Secret-Asset Pairs in Software Artifacts
por: Basak, Setu Kumar, et al.
Publicado: (2024)

Profile of Vulnerability Remediations in Dependencies Using Graph Analysis
por: Vera, Fernando, et al.
Publicado: (2024)

Can I Check What I Designed? Mapping Security Design DSLs to Code Analyzers
por: Peldszus, Sven, et al.
Publicado: (2026)

BacAlarm: Mining and Simulating Composite API Traffic to Prevent Broken Access Control Violations
por: Yang, Yanjing, et al.
Publicado: (2025)

Does the Vulnerability Threaten Our Projects? Automated Vulnerable API Detection for Third-Party Libraries
por: Zhang, Fangyuan, et al.
Publicado: (2024)

A Static Analysis of Popular C Packages in Linux
por: Ruohonen, Jukka, et al.
Publicado: (2024)

An Analysis of Malicious Packages in Open-Source Software in the Wild
por: Zhou, Xiaoyan, et al.
Publicado: (2024)

SAGA: Detecting Security Vulnerabilities Using Static Aspect Analysis
por: Marquer, Yoann, et al.
Publicado: (2026)

Using LLMs for Security Advisory Investigations: How Far Are We?
por: Abdullah, Bayu Fedra, et al.
Publicado: (2025)

SAVANT: Vulnerability Detection in Application Dependencies through Semantic-Guided Reachability Analysis
por: Lingxiang, Wang, et al.
Publicado: (2025)

Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem
por: Zahan, Nusrat, et al.
Publicado: (2025)

CHASE: LLM Agents for Dissecting Malicious PyPI Packages
por: Toda, Takaaki, et al.
Publicado: (2026)

Just another copy and paste? Comparing the security vulnerabilities of ChatGPT generated code and StackOverflow answers
por: Hamer, Sivana, et al.
Publicado: (2024)