{"id":"https://openalex.org/W4411260246","doi":"https://doi.org/10.1145/3729304","title":"Automated Exploit Generation for Node.js Packages","display_name":"Automated Exploit Generation for Node.js Packages","publication_year":2025,"publication_date":"2025-06-10","ids":{"openalex":"https://openalex.org/W4411260246","doi":"https://doi.org/10.1145/3729304"},"language":"en","primary_location":{"id":"doi:10.1145/3729304","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3729304","pdf_url":null,"source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1145/3729304","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5020930942","display_name":"F. A. Marques","orcid":"https://orcid.org/0000-0002-2555-5382"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I141596103","display_name":"University of Lisbon","ror":"https://ror.org/01c27hj86","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103"]},{"id":"https://openalex.org/I203847022","display_name":"Instituto Polit\u00e9cnico de Lisboa","ror":"https://ror.org/04ea70f07","country_code":"PT","type":"education","lineage":["https://openalex.org/I203847022"]}],"countries":["PT"],"is_corresponding":true,"raw_author_name":"Filipe Marques","raw_affiliation_strings":["INESC-ID, Lisboa, Portugal","Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal"],"affiliations":[{"raw_affiliation_string":"INESC-ID, Lisboa, Portugal","institution_ids":["https://openalex.org/I121345201"]},{"raw_affiliation_string":"Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal","institution_ids":["https://openalex.org/I203847022","https://openalex.org/I141596103"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5101457638","display_name":"Mafalda Ferreira","orcid":"https://orcid.org/0000-0002-5307-4279"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I141596103","display_name":"University of Lisbon","ror":"https://ror.org/01c27hj86","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103"]},{"id":"https://openalex.org/I203847022","display_name":"Instituto Polit\u00e9cnico de Lisboa","ror":"https://ror.org/04ea70f07","country_code":"PT","type":"education","lineage":["https://openalex.org/I203847022"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Mafalda Ferreira","raw_affiliation_strings":["INESC-ID, Lisboa, Portugal","Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal"],"affiliations":[{"raw_affiliation_string":"INESC-ID, Lisboa, Portugal","institution_ids":["https://openalex.org/I121345201"]},{"raw_affiliation_string":"Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal","institution_ids":["https://openalex.org/I203847022","https://openalex.org/I141596103"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5111165389","display_name":"Andr\u00e9 Nascimento","orcid":"https://orcid.org/0009-0000-0043-3613"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I141596103","display_name":"University of Lisbon","ror":"https://ror.org/01c27hj86","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103"]},{"id":"https://openalex.org/I203847022","display_name":"Instituto Polit\u00e9cnico de Lisboa","ror":"https://ror.org/04ea70f07","country_code":"PT","type":"education","lineage":["https://openalex.org/I203847022"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Andr\u00e9 Nascimento","raw_affiliation_strings":["INESC-ID, Lisboa, Portugal","Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal"],"affiliations":[{"raw_affiliation_string":"INESC-ID, Lisboa, Portugal","institution_ids":["https://openalex.org/I121345201"]},{"raw_affiliation_string":"Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal","institution_ids":["https://openalex.org/I203847022","https://openalex.org/I141596103"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036001075","display_name":"Miguel E. Coimbra","orcid":"https://orcid.org/0000-0002-7191-5895"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I141596103","display_name":"University of Lisbon","ror":"https://ror.org/01c27hj86","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103"]},{"id":"https://openalex.org/I203847022","display_name":"Instituto Polit\u00e9cnico de Lisboa","ror":"https://ror.org/04ea70f07","country_code":"PT","type":"education","lineage":["https://openalex.org/I203847022"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Miguel E. Coimbra","raw_affiliation_strings":["INESC-ID, Lisboa, Portugal","Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal"],"affiliations":[{"raw_affiliation_string":"INESC-ID, Lisboa, Portugal","institution_ids":["https://openalex.org/I121345201"]},{"raw_affiliation_string":"Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal","institution_ids":["https://openalex.org/I203847022","https://openalex.org/I141596103"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075037126","display_name":"Nuno Santos","orcid":"https://orcid.org/0000-0001-9938-0653"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I141596103","display_name":"University of Lisbon","ror":"https://ror.org/01c27hj86","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103"]},{"id":"https://openalex.org/I203847022","display_name":"Instituto Polit\u00e9cnico de Lisboa","ror":"https://ror.org/04ea70f07","country_code":"PT","type":"education","lineage":["https://openalex.org/I203847022"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Nuno Santos","raw_affiliation_strings":["INESC-ID, Lisboa, Portugal","Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal"],"affiliations":[{"raw_affiliation_string":"INESC-ID, Lisboa, Portugal","institution_ids":["https://openalex.org/I121345201"]},{"raw_affiliation_string":"Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal","institution_ids":["https://openalex.org/I203847022","https://openalex.org/I141596103"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5087946116","display_name":"Limin Jia","orcid":"https://orcid.org/0000-0002-8160-349X"},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Limin Jia","raw_affiliation_strings":["Carnegie Mellon University, Pittsburgh, USA"],"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University, Pittsburgh, USA","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5061566620","display_name":"Jos\u00e9 Fragoso Santos","orcid":"https://orcid.org/0000-0001-5077-300X"},"institutions":[{"id":"https://openalex.org/I121345201","display_name":"Instituto de Engenharia de Sistemas e Computadores Investiga\u00e7\u00e3o e Desenvolvimento","ror":"https://ror.org/04mqy3p58","country_code":"PT","type":"nonprofit","lineage":["https://openalex.org/I121345201","https://openalex.org/I4210125590"]},{"id":"https://openalex.org/I141596103","display_name":"University of Lisbon","ror":"https://ror.org/01c27hj86","country_code":"PT","type":"education","lineage":["https://openalex.org/I141596103"]},{"id":"https://openalex.org/I203847022","display_name":"Instituto Polit\u00e9cnico de Lisboa","ror":"https://ror.org/04ea70f07","country_code":"PT","type":"education","lineage":["https://openalex.org/I203847022"]}],"countries":["PT"],"is_corresponding":false,"raw_author_name":"Jos\u00e9 Fragoso Santos","raw_affiliation_strings":["INESC-ID, Lisboa, Portugal","Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal"],"affiliations":[{"raw_affiliation_string":"INESC-ID, Lisboa, Portugal","institution_ids":["https://openalex.org/I121345201"]},{"raw_affiliation_string":"Instituto Superior T\u00e9cnico, Universidade de Lisboa, Lisboa, Portugal","institution_ids":["https://openalex.org/I203847022","https://openalex.org/I141596103"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":7,"corresponding_author_ids":["https://openalex.org/A5020930942"],"corresponding_institution_ids":["https://openalex.org/I121345201","https://openalex.org/I141596103","https://openalex.org/I203847022"],"apc_list":null,"apc_paid":null,"fwci":4.6237,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.93643633,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":96},"biblio":{"volume":"9","issue":"PLDI","first_page":"1341","last_page":"1366"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11241","display_name":"Advanced Malware Detection Techniques","score":0.9976999759674072,"subfield":{"id":"https://openalex.org/subfields/1711","display_name":"Signal Processing"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.9965000152587891,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.9356101751327515},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.684825599193573},{"id":"https://openalex.org/keywords/node","display_name":"Node (physics)","score":0.5302999019622803},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.16601839661598206},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.10688036680221558}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.9356101751327515},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.684825599193573},{"id":"https://openalex.org/C62611344","wikidata":"https://www.wikidata.org/wiki/Q1062658","display_name":"Node (physics)","level":2,"score":0.5302999019622803},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.16601839661598206},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.10688036680221558},{"id":"https://openalex.org/C66938386","wikidata":"https://www.wikidata.org/wiki/Q633538","display_name":"Structural engineering","level":1,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3729304","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3729304","pdf_url":null,"source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1145/3729304","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3729304","pdf_url":null,"source":{"id":"https://openalex.org/S4210216081","display_name":"Proceedings of the ACM on Programming Languages","issn_l":"2475-1421","issn":["2475-1421"],"is_oa":true,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM on Programming Languages","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":56,"referenced_works":["https://openalex.org/W1710734607","https://openalex.org/W1720848645","https://openalex.org/W1777881387","https://openalex.org/W1991074244","https://openalex.org/W1992114977","https://openalex.org/W2031381791","https://openalex.org/W2039173453","https://openalex.org/W2042033151","https://openalex.org/W2060218972","https://openalex.org/W2083318332","https://openalex.org/W2087567537","https://openalex.org/W2107709519","https://openalex.org/W2132897303","https://openalex.org/W2136601052","https://openalex.org/W2140687990","https://openalex.org/W2574017551","https://openalex.org/W2591793539","https://openalex.org/W2735438339","https://openalex.org/W2752602409","https://openalex.org/W2765363641","https://openalex.org/W2790761820","https://openalex.org/W2806377938","https://openalex.org/W2885626945","https://openalex.org/W2898614297","https://openalex.org/W2899983867","https://openalex.org/W2902040535","https://openalex.org/W2910728092","https://openalex.org/W2955835447","https://openalex.org/W2963298680","https://openalex.org/W2963723316","https://openalex.org/W2967904600","https://openalex.org/W2979357014","https://openalex.org/W3017541286","https://openalex.org/W3033206483","https://openalex.org/W3046732376","https://openalex.org/W3086089336","https://openalex.org/W3164306598","https://openalex.org/W3173198614","https://openalex.org/W3186856650","https://openalex.org/W4205786399","https://openalex.org/W4224744482","https://openalex.org/W4237492309","https://openalex.org/W4284694562","https://openalex.org/W4288286273","https://openalex.org/W4302415009","https://openalex.org/W4324007235","https://openalex.org/W4382724811","https://openalex.org/W4384302790","https://openalex.org/W4385080286","https://openalex.org/W4385080345","https://openalex.org/W4385412470","https://openalex.org/W4399851459","https://openalex.org/W4400102856","https://openalex.org/W4403223513","https://openalex.org/W4408749993","https://openalex.org/W6930791674"],"related_works":["https://openalex.org/W4391375266","https://openalex.org/W2899084033","https://openalex.org/W2748952813","https://openalex.org/W17155033","https://openalex.org/W3207760230","https://openalex.org/W1496222301","https://openalex.org/W4312814274","https://openalex.org/W1590307681","https://openalex.org/W2536018345","https://openalex.org/W4285370786"],"abstract_inverted_index":{"The":[0,129],"Node.js":[1,33,98,139,161],"ecosystem,":[2],"with":[3,141,168],"its":[4,152],"growing":[5],"popularity":[6],"and":[7,104,121],"increasing":[8],"exposure":[9],"to":[10,39,59,68,94,159],"security":[11,20],"vulnerabilities,":[12,124,167],"has":[13],"a":[14,55],"pressing":[15],"need":[16],"for":[17],"more":[18,73,149],"effective":[19],"analysis":[21,103],"tools.":[22,155],"To":[23],"reduce":[24],"false":[25,127],"positives,":[26],"recent":[27],"works":[28],"on":[29,48,134],"detecting":[30],"vulnerabilities":[31,49,96,143],"in":[32,97],"packages":[34,140],"have":[35],"developed":[36],"synthesis":[37],"algorithms":[38],"generate":[40,69],"proof-of-concept":[41],"exploits.":[42],"However,":[43],"these":[44],"tools":[45],"focus":[46],"mainly":[47],"that":[50,71,89,111,145],"can":[51],"be":[52],"triggered":[53],"by":[54],"single":[56],"direct":[57],"call":[58,92],"an":[60],"exported":[61],"function":[62],"of":[63,86,115,131,138],"the":[64,82,113],"analyzed":[65],"package,":[66],"failing":[67],"exploits":[70,88,110,150],"require":[72],"complex":[74,91],"interactions.":[75],"In":[76],"this":[77],"paper,":[78],"we":[79],"present":[80],"Explode.js,":[81],"first":[83],"tool":[84],"capable":[85],"synthesizing":[87],"include":[90],"sequences":[93],"trigger":[95],"packages.":[99],"By":[100],"combining":[101],"static":[102],"symbolic":[105],"execution,":[106],"Explode.js":[107,133,163],"generates":[108,147],"functional":[109],"confirm":[112],"existence":[114],"command,":[116],"code":[117],"injection,":[118],"prototype":[119],"pollution,":[120],"path":[122],"traversal":[123],"effectively":[125],"eliminating":[126],"positives.":[128],"results":[130],"evaluating":[132],"two":[135],"state-of-the-art":[136],"datasets":[137],"confirmed":[142],"show":[144],"it":[146],"significantly":[148],"than":[151],"main":[153],"competitor":[154],"Furthermore,":[156],"when":[157],"applied":[158],"real-world":[160],"packages,":[162],"uncovered":[164],"44":[165],"zero-day":[166],"4":[169],"new":[170],"CVEs.":[171]},"counts_by_year":[{"year":2025,"cited_by_count":2}],"updated_date":"2026-03-27T05:58:40.876381","created_date":"2025-10-10T00:00:00"}