More Like this

1. ConfuGuard: Using Metadata to Detect Active and Stealthy Package Confusion Attacks Accurately and at Scale

   Jiang, Wenxin; Çakar, Berk; Lysenko, Mikola; Davis, James C (August 2025, International Conference on Software Engineering (ICSE) 2026)

   Package confusion attacks such as typosquatting threaten soft- ware supply chains. Attackers make packages with names that syntactically or semantically resemble legitimate ones, trick- ing engineers into installing malware. While prior work has developed defenses against package confusions in some soft- ware package registries, notably NPM, PyPI, and RubyGems, gaps remain: high false-positive rates, generalization to more software package ecosystems, and insights from real-world deployment. In this work, we introduce ConfuGuard, a state-of-art de- tector for package confusion threats. We begin by presenting the first empirical analysis of benign signals derived from prior package confusion data, uncovering their threat patterns, engineering practices, and measurable attributes. Advancing existing detectors, we leverage package metadata to distin- guish benign packages, and extend support from three up to seven software package registries. Our approach significantly reduces false positive rates (from 80% to 28%), at the cost of an additional 14s average latency to filter out benign pack- ages by analyzing the package metadata. ConfuGuard is used in production at our industry partner, whose analysts have already confirmed 630 real attacks detected by ConfuGuard 

   more » « less
2. Containing Malicious Package Updates in npm with a Lightweight Permission System

   https://doi.org/10.1109/ICSE43902.2021.00121  

   Ferreira, Gabriel; Jia, Limin; Sunshine, Joshua; Kastner, Christian (May 2021, 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE))

   The large amount of third-party packages available in fast-moving software ecosystems, such as Node.js/npm, enables attackers to compromise applications by pushing malicious updates to their package dependencies. Studying the npm repository, we observed that many packages in the npm repository that are used in Node.js applications perform only simple computations and do not need access to filesystem or network APIs. This offers the opportunity to enforce least-privilege design per package, protecting applications and package dependencies from malicious updates. We propose a lightweight permission system that protects Node.js applications by enforcing package permissions at runtime. We discuss the design space of solutions and show that our system makes a large number of packages much harder to be exploited, almost for free. 

   more » « less
3. Fasano-Franceschini Test: an Implementation of a 2-Dimensional Kolmogorov-Smirnov test in R

   https://doi.org/10.48550/arXiv.2106.10539  

   Ness-Cohn, Elan; Braun, Rosemary (September 2021, ArXivorg)

   The univariate Kolmogorov-Smirnov (KS) test is a non-parametric statistical test designed to assess whether two samples come from the same underlying distribution. The versatility of the KS test has made it a cornerstone of statistical analysis across the scientific disciplines. However, the test proposed by Kolmogorov and Smirnov does not naturally extend to multidimensional distributions. Here, we present the fasano.franceschini.test package, an R implementation of the 2-D KS two-sample test as defined by Fasano and Franceschini (Fasano and Franceschini 1987) and provide multiple use cases across the scientific disciplines. The fasano.franceschini.test package provides three improvements over the current 2-D KS test on the Comprehensive R Archive Network (CRAN): (i) the Fasano and Franceschini test has been shown to run in O(n2) versus the Peacock implementation which runs in O(n3); (ii) the package implements a procedure for handling ties in the data; and (iii) the package implements a parallelized permutation procedure for improved significance testing. Ultimately, the fasano.franceschini.test package presents a robust statistical test for analyzing random samples defined in 2-dimensions. 

   more » « less
4. Chiplet-Package Co-Design For 2.5D Systems Using Standard ASIC CAD Tools

   https://doi.org/10.1109/ASP-DAC47756.2020.9045734  

   Kabir, MD Arafat; Peng, Yarui (January 2020, 2020 25th Asia and South Pacific Design Automation Conference (ASP-DAC))

   Chiplet integration using 2.5D packaging is gaining popularity nowadays which enables several interesting features like heterogeneous integration and drop-in design method. In the traditional die-by-die approach of designing a 2.5D system, each chiplet is designed independently without any knowledge of the package RDLs. In this paper, we propose a Chip-Package Co-Design flow for implementing 2.5D systems using existing commercial chip design tools. Our flow encompasses 2.5D-aware partitioning suitable for SoC design, Chip-Package Floorplanning, and post-design analysis and verification of the entire 2.5D system. We also designed our own package planners to route RDL layers on top of chiplet layers. We use an ARM Cortex-M0 SoC system to illustrate our flow and compare analysis results with a monolithic 2D implementation of the same system. We also compare two different 2.5D implementations of the same SoC system following the drop-in approach. Alongside the traditional die-by-die approach, our holistic flow enables design efficiency and flexibility with accurate cross-boundary parasitic extraction and design verification. 

   more » « less
5. VDAC Solvation Free Energy Calculation by a Nonuniform Size Modified Poisson–Boltzmann Ion Channel Model

   https://doi.org/10.1002/jcc.70003  

   Jemison, Liam; Stahl, Matthew; Dash, Ranjan_K; Xie, Dexuan (December 2024, Journal of Computational Chemistry)

   ABSTRACT Voltage‐dependent anion channel (VDAC) is the primary conduit for regulated passage of ions and metabolites into and out of a mitochondrion. Calculating the solvation free energy for VDAC is crucial for understanding its stability, function, and interactions within the cellular environment. In this article, numerical schemes for computing the total solvation free energy for VDAC—comprising electrostatic, ideal gas, and excess free energies plus the nonpolar energy—are developed based on a nonuniform size modified Poisson–Boltzmann ion channel (nuSMPBIC) finite element solver along with tetrahedral meshes for VDAC proteins. The current mesh generation package is also updated to improve mesh quality and accelerate mesh generation. A VDAC Solvation Free Energy Calculation (VSFEC) package is then created by integrating these schemes with the updated mesh package, the nuSMPBIC finite element package, the PDB2PQR package, and the OPM database, as well as one uniform SMPBIC finite element package and one Poisson–Boltzmann ion channel (PBIC) finite element package. With the VSFEC package, many numerical experiments are made using six VDAC proteins, eight ionic solutions containing up to four ionic species, including ATP⁴⁻and Ca²⁺, two reference states, different boundary values, and different permittivity constants. The test results underscore the importance of considering nonuniform ionic size effects to explore the varying patterns of the total solvation free energy, and demonstrate the high performance of the VSFEC package for VDAC solvation free energy calculation. 

   more » « less