Modern software stacks are built on open-source components distributed through package managers and automated pipelines. Our work measures how vulnerabilities evolve through dependency graphs, how security mechanisms such as package signing and backup practices behave in the real world, and how adversaries abuse trust in the supply chain — from forged signatures to compromised package registries.
Measure how vulnerabilities propagate through dependency graphs, how package signing is implemented and enforced across ecosystems, and how users actually configure backup defenses in practice.
Connect empirical signals — signing gaps, vulnerability evolution patterns, backup mismatches — to attacker opportunity, downstream risk, and the structural weaknesses that make supply chains exploitable.
Identify where automated gatekeeping can reduce vulnerability propagation risk most efficiently, and where mismatches between user assumptions and actual recoverability create the highest exposure.
Produce measurements, tools, and findings that inform maintainers, package ecosystem policy decisions, and user-facing guidance on supply chain integrity and resilience.
Our work tracks how vulnerabilities are introduced, patched, and re-introduced as dependencies evolve across open-source ecosystems. We empirically measure how signature verification is implemented across major package registries — identifying systematic gaps between declared security posture and actual enforcement. Outguard measures how cryptojacking scripts propagate through third-party inclusions and open-source CDN pipelines. Broken Gates examines how LLM-driven agents expose new attack surfaces in automated web interactions. A parallel study characterizes real-world backup behavior, revealing mismatches between user assumptions and actual recoverability.
Justified by: Vulnerability Evolution (RAID'26) • Forged Signatures (IEMCON'25) • Outguard (WWW'19) • Broken Gates (2025) • User Backup (IEMCON'25)Vulnerability evolution analysis shows how the patch-and-reintroduce cycle creates persistent exposure windows in dependency graphs. The forged signatures study maps how differential trust decisions across browsers and OS components create attacker opportunity that is low-cost and systematic. Outguard reveals how cryptojacking campaigns exploit open-source CDN trust to run undetected across thousands of sites. Broken Gates analyzes how LLM agent capabilities outpace current bot defenses, reframing the trust assumptions underlying automated access controls. User backup behavior reveals that subjective confidence in recoverability often diverges sharply from objective backup state.
Justified by: Vulnerability Evolution (RAID'26) • Forged Signatures (IEMCON'25) • Outguard (WWW'19) • Broken Gates (2025) • User Backup (IEMCON'25)Vulnerability evolution findings isolate which phases of the dependency lifecycle are highest-leverage targets for automated gatekeeping — focusing maintainer attention where reintroduction risk is greatest. The forged signatures study pinpoints the browser-OS boundary as a particularly under-enforced control point. Backup behavior data shows which configuration gaps lead to the largest recoverability shortfalls.
Justified by: Vulnerability Evolution (RAID'26) • Forged Signatures (IEMCON'25) • User Backup (IEMCON'25)Our vulnerability evolution work provides concrete evidence for where automated gatekeeping tools should be deployed in CI/CD pipelines and dependency update workflows. The forged signatures study demonstrates that a browser extension can significantly reduce the exposed attack surface from certificate abuse. Backup behavior findings directly inform the design of user-facing recovery guidance and ecosystem-level policy.
Justified by: Vulnerability Evolution (RAID'26) • Forged Signatures (IEMCON'25) • User Backup (IEMCON'25)This work studies how vulnerabilities evolve through the open-source software lifecycle — how they are introduced, patched, and re-introduced as dependencies change over time. The study provides empirical grounding for where automated gatekeeping mechanisms can most effectively reduce vulnerability propagation risk across dependency graphs, identifying structural patterns in vulnerability evolution that inform the design of CI/CD pipeline interventions and dependency update policies.
Cryptojacking scripts frequently enter websites through compromised or malicious third-party inclusions and open-source CDN dependencies — making in-browser mining a supply-chain trust problem as much as a web security one. Outguard instruments browser parallelism primitives rather than CPU thresholds or static signatures to detect these campaigns behaviorally. Deployed in the wild, it identified 35 active campaigns, 6,328 cryptojacking websites, and 24 previously unreported mining services, demonstrating that behavioral fingerprinting generalizes across obfuscated variants distributed through open-source supply channels.
Package signing is increasingly promoted as a supply-chain integrity control, yet its real-world adoption and enforcement remain poorly understood. This work empirically evaluates how signature verification is implemented across major package ecosystems and how modern browsers respond to untrusted, signed malicious binaries. The study identifies systematic gaps between declared security posture and actual enforcement — revealing that browser responses differ significantly from one another, and that a browser extension can substantially reduce the attack surface exposed by certificate abuse.
Backup systems are a last line of defense against data loss from ransomware and supply-chain attacks, yet empirical data on how users actually configure and rely on them is scarce. This study characterizes real-world backup behavior at scale, revealing systematic mismatches between user confidence in their recoverability and the actual state of their backups. The findings show that subjective assumptions about backup adequacy frequently diverge from objective configuration data — undermining the effectiveness of backup-based defenses and directly informing the design of more reliable user-facing recovery guidance.
← Back to Research Full publication list