一句话：提出交互式可视化工具 V-Achilles，用依赖图帮助 npm 用户理解和更新传递性安全漏洞。
第三方依赖的安全漏洞会威胁用户应用，而 npm 生态中的库用户不仅受直接依赖影响，也受传递依赖影响。已有工具多支持漏洞依赖更新，但很少展示传递更新的复杂性。本文提出 V-Achilles，一个面向 npm 的原型工具，通过依赖图可视化受漏洞攻击影响的依赖关系，帮助开发者理解传递性安全漏洞及其更新路径。作者介绍了工具概览，并用三个基于真实 npm 包的用例展示其有用性与应用场景。原型已在 GitHub 公开，并提供了视频演示。该工作属于开发者工具与安全漏洞管理交叉方向，重点在于交互式可视化对传递依赖漏洞更新的支持。
A key threat to the usage of third-party dependencies has been the threat of security vulnerabilities, which risks unwanted access to a user application. As part of an ecosystem of dependencies, users of a library are prone to both the direct and transitive dependencies adopted into their applications. Recent work involves tool supports for vulnerable dependency updates, rarely showing the complexity of the transitive updates. In this paper, we introduce our solution to support vulnerability updating in npm. V-Achilles is a prototype that shows a visualization (i.e., using dependency graphs) affected by vulnerability attacks. In addition to the tool overview, we highlight three use cases to demonstrate the usefulness and application of our prototype with real-world npm packages. The prototype is available at https://github.com/MUICT-SERU/V-Achilles, with an accompanying video demonstration at https://www.youtube.com/watch?v=tspiZfhMNcs.
@inproceedings{paperbot7150,
title = {V-Achilles: An Interactive Visualization of Transitive Security Vulnerabilities},
author = {Vipawan Jarukitpipat and Klinton Chhun and Wachirayana Wanprasert and Chaiyong Ragkhitwetsagul and Morakot Choetkiertikul and Thanwadee Sunetnanta and Raula Gaikovina Kula and Bodin Chinthanet and Takashi Ishio and Kenichi Matsumoto},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3559526}
}