一句话：提出 Aletheia 从 JS bundle 识别包版本，并大规模测量 Web 依赖更新与漏洞情况。
现代 JavaScript 开发高度依赖 npm 包，但下载统计显示脆弱版本仍很流行，其在生产网站上的真实普及情况和更新行为尚不清楚。现有包版本检测方法多针对手选热门包或使用全局命名空间的单文件资源，难以大规模分析现代 Web 应用的依赖更新行为。本文提出 Aletheia：一种包无关的方法，利用抄袭检测领域的算法剖析 JavaScript bundle，从而识别其中使用的包及其版本。作者在实用场景下证明 Aletheia 明显优于现有方法，并爬取 Tranco 前 10 万域名进行纵向分析。结果显示，5% 到 20% 的域名在 16 周内更新依赖；打包包比 CDN 引入的包更新显著更快，已知脆弱包版本最多少 10 倍；但少数广泛供应商似乎是及时更新的主要驱动力，说明纯定量指标并未呈现完整图景。
Reusable software components, typically distributed as packages, are a central paradigm of modern software development. The JavaScript ecosystem serves as a prime example, offering millions of packages with their use being promoted as idiomatic. However, download statistics on npm raise security concerns as they indicate a high popularity of vulnerable package versions while their real prevalence on production websites remains unknown. Package version detection mechanisms fill this gap by extracting utilized packages and versions from observed artifacts on the web. Prior research focuses on mechanisms for either hand-selected popular packages in bundles or for single-file resources utilizing the global namespace. This does not allow for a thorough analysis of modern web applications’ dependency update behavior at scale. In this work, we improve upon this by presenting Aletheia, a package-agnostic method which dissects JavaScript bundles to identify package versions through algorithms originating from the field of plagiarism detection. We show that Aletheia clearly outperforms the existing approaches in practical settings. Furthermore, we crawl the Tranco top 100,000 domains to reveal that 5% to 20% of domains update their dependencies within 16 weeks. Surprisingly, from a longitudinal perspective, bundled packages are updated significantly faster than their CDN-included counterparts, with consequently up to 10 times fewer known vulnerable package versions included. Still, we observe indicators that few widespread vendors seem to be a major driving force behind timely updates, implying that quantitative measures are not painting a complete picture.
@inproceedings{abs-2512-15447,
title = {Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web},
author = {Ben Swierzy and Marc Ohm and Michael Meier},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3787780}
}