Thumbnail for Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web"

Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web"

Name: Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web"
Published: 2026-01-22
License: https://mit-license.org/

Open this dataset in the live repository

Important usage condition: Use and redistribution are governed by MIT. Review and comply with the license before using the data.

Persistent identifier: doi:10.60507/FK2/F4VQRH
Published version: 1.0
Publication date: 2026-01-22
License: MIT

Description

This dataset contains software artifacts for the paper "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web". It includes all software artifacts (crawler, Aletheia implementation, evaluation scripts) used for analysis. For the re-implementation of Dolos (dolospy), please check the related material.

Creators

Swierzy, Ben

Keywords

javascript, bundles, software composition analysis, update behavior

Files

Before downloading: Use and redistribution are governed by MIT. Review and comply with the license before using the data.

File	Type	Bytes	Checksum
USAGE.md	text/markdown	2974	MD5 2c624e22fcfa95d6f0dd6d1c6dbde10a
readme.txt	text/plain	2856	MD5 8b76cf2041bb631edcda6f0e5e797977
requirements.txt	text/plain	41	MD5 9b395415b38184b079b6e02030fbc83f
Dockerfile	application/x-docker-file	371	MD5 f25e060a37613d1acc69fed094664238
puppeteer.mjs	application/x-javascript	8437	MD5 10230469336cd880204bbbeaa8c560cc
docker-compose.yml	application/yaml	4581	MD5 d9874430b058839bc0bb59a08479ab0a
domainlist.py	text/x-python	1399	MD5 2df8ec6ffbbfe45abe3bc3460c49fe9d
Dockerfile	application/x-docker-file	962	MD5 c03ed0fe6f21b68059f318eb5cfd94f9
rabbitmq.conf	text/plain	29	MD5 f4b6d7d40be8573eb4c7393c7e9fcf9b
requirements.txt	text/plain	23	MD5 2ad69b65dfd12d497c3169c7cd65c1b1
bundlefetcher-stealth.py	text/x-python	3604	MD5 2d2c103f197a7f6f795289abe569a877
Dockerfile	application/x-docker-file	338	MD5 28ba72d5f1378078495d68c78c86e15b
throttle.py	text/x-python	1116	MD5 e8585fe4852833d9942e4a38d4cd2834
requirements.txt	text/plain	39	MD5 43b4211a0e5e6b72ef0281fecddd66a4
entrypoint.sh	application/x-shellscript	124	MD5 a72283d98a83758f2a253282d7888766
Dockerfile	application/x-docker-file	201	MD5 83b4230f466ebfc3222c3451a488bad0
requirements.txt	text/plain	23	MD5 2ad69b65dfd12d497c3169c7cd65c1b1
hev.yml	application/yaml	185	MD5 6c208b9e6153fca338a4b50ddacf1490
Dockerfile	application/x-docker-file	165	MD5 aff88dc30838dcef00221563b1dfb7be
separating-collector.py	text/x-python	2995	MD5 c4edcd9abcb6f0d03791ec3ce3396d7e
Dockerfile	application/x-docker-file	183	MD5 4e54c40f0a75f36ba57fde3dae118a12
__init__.py	text/x-python	10201	MD5 49b0444c87d1235c93a9c587e1fc601a
requirements.txt	text/plain	23	MD5 2ad69b65dfd12d497c3169c7cd65c1b1
object-storage.py	text/x-python	1156	MD5 78ba537b12e6f4646676ffdf4f6d9534
pyproject.toml	application/toml	270	MD5 14f6906aca9e20a444b5edb60dbb9ab0
pack_bundles.py	text/x-python	2215	MD5 955d3d1a8d746f5a1cc7ae0b348bf3db
bun-serve.mjs	application/x-javascript	1251	MD5 326ee886e869e25876b7bce8d2abb131
common.py	text/x-python	7256	MD5 aa6c25ae929ffaefa9718000a7bc63b5
generate_bundles.py	text/x-python	6732	MD5 72472bdb6026604a7f002598147423b6
update-patterns-pnpm.ipynb	application/x-ipynb+json	19105	MD5 9ea8ceb03f53f94576e714b8f4f7a0aa
aletheia-preprocessor.worker.mjs	application/x-javascript	330	MD5 03d01fcb74b17dafeb26d9f6368bf8a8
file-selector.mjs	application/x-javascript	18309	MD5 ca924fdcad4619cac835676cf5c79f6d
update-patterns-cdn.ipynb	application/x-ipynb+json	30789	MD5 424766feb87dfdb71cef8b118b7b4d3e
aletheia-serializer.mjs	application/x-javascript	3826	MD5 0c47041e114325daf03eb045354a3459
identify.mjs	application/x-javascript	11800	MD5 3ff10c4413cb152d0000eab570893691
npm_mirror.py	text/x-python	2425	MD5 d6dbb8ac9edf1883770a81f223eeeb7f
lab-bundler-study.ipynb	application/x-ipynb+json	16995	MD5 58ef9f37bbd94b7819171f155f8db89f
real-aletheia.ipynb	application/x-ipynb+json	16760	MD5 8a3b78e088120517634b4b724a8c99fd
identify_compartments.mjs	application/x-javascript	20676	MD5 a40a55abe68f0ef834bc1f38f4ec33d7
vulnerability-database.py	text/x-python	6749	MD5 ee31c51dc40056cef2528e184f7f8489
biome.json	application/json	496	MD5 33c91f04f9e74bead8d68370b85f67bb
local_version_fetcher.py	text/x-python	2349	MD5 dc9683436fac3e5e247cf7425d5d0c91
real-bundler-study.ipynb	application/x-ipynb+json	15768	MD5 6aece082637e9fe7cc2860954cf2036d
lab-aletheia.ipynb	application/x-ipynb+json	21629	MD5 d25a17950af73150a5fd21ee03d1bcdb
file-selection.pdf	application/pdf	200611	MD5 20f4c96871ee78b976d6422dfcbafac5
aletheia_speed_eval.py	text/x-python	10451	MD5 649417594fdee2dd96a722d083a0fa2d
aletheia_speed_eval_recover.py	text/x-python	4325	MD5 543883e4bf33a5c732271b6e1d2bf0f8
aletheia_speed_eval_real_vd.py	text/x-python	10172	MD5 fbaa517e5e9e40af51137f1a33588fd3
identify_bundler.mjs	application/x-javascript	23130	MD5 068ad52388ff5e98fa633790de63a80a
utils.mjs	application/x-javascript	464	MD5 39d620da675b85c0f4a2bb99f27b0c80
bundler-prevalence.ipynb	application/x-ipynb+json	5421	MD5 b2bc7b74c0c5acaf80493ef34e95cf14
package.json	application/json	342	MD5 f6a15f4a75985d486d8fdc7644108078
cdn-urls.ipynb	application/x-ipynb+json	8489	MD5 e154795007f0b102193bdc82f58065e3
aletheia-preprocessor.mjs	application/x-javascript	9368	MD5 6962870da65948ec97628c21135006ca
update-patterns-aletheia.ipynb	application/x-ipynb+json	60515	MD5 6aa102ea51c16c3735df38406ecab5db
analyze_bundle_dataset.py	text/x-python	29463	MD5 3ba7758094ef773372b3a6022e1f7725

Citation

Swierzy, Ben, 2026-01-22, Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web", doi:10.60507/FK2/F4VQRH, V1.0

Additional Dataverse fields

Id	556
Dataset Type	dataset
Internal Version Number	33
Latest Version Publishing State	RELEASED
Release Time	2026-01-22T11:48:09Z
Create Time	2026-01-09T12:17:24Z
Citation Date	2026-01-22
File Access Request	True

Export metadata

Static metadata exports available for this published dataset version:

Complete Dataverse metadata

Citation Metadata

Title title

Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web"

Alternative URL alternativeURL

https://github.com/BlobbyBob/AletheiaJSVersionDetection

Author author

Author Name
Swierzy, Ben
Author Affiliation
University of Bonn
Author Identifier Scheme
ORCID
Author Identifier
Type Name
authorIdentifier
Multiple
False
Type Class
primitive
Value
https://orcid.org/0009-0003-0485-4791
Expandedvalue
Person Name
Swierzy, Ben
@id
https://orcid.org/0009-0003-0485-4791
Scheme
ORCID
@type
https://schema.org/Person

Dataset Contact datasetContact

Dataset Contact Name
Swierzy, Ben
Dataset Contact Affiliation
University of Bonn
Dataset Contact Email
swierzy@cs.uni-bonn.de

Ds Description dsDescription

Ds Description Value
This dataset contains software artifacts for the paper "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web". It includes all software artifacts (crawler, Aletheia implementation, evaluation scripts) used for analysis. For the re-implementation of Dolos (dolospy), please check the related material.

Subject subject

Computer and Information Science

Subject Refinement subjectRefinement

Subject Refinement Value
Computer Science: Software Engineering and Programming Languages [409-02]
Subject Refinement Value
Computer Science: Security and Dependability [409-03]

Free Keyword freeKeyword

Free Keyword Value
javascript
Free Keyword Value
bundles
Free Keyword Value
software composition analysis
Free Keyword Value
update behavior

Publication publication

Publication Relation Type
IsSupplementTo
Publication Citation
Ben Swierzy, Marc Ohm, and Michael Meier. 2026. Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web. In 2026 IEEE/ACM 48th International Conference on Software Engineering (ICSE ’26), April 12–18, 2026, Rio de Janeiro, Brazil. ACM, New York, NY, USA, 13 pages. https://doi.org/10.1145/3744916.3787780
Publication IDType
doi
Publication IDNumber
10.1145/3744916.3787780
Publication URL
https://dl.acm.org/doi/abs/10.1145/3744916.3787780
Publication Relation Type
IsSupplementTo
Publication Citation
Swierzy, Ben, Marc Ohm, and Michael Meier. "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web." arXiv preprint arXiv:2512.15447 (2025).
Publication IDType
doi
Publication IDNumber
10.48550/arXiv.2512.15447
Publication URL
https://arxiv.org/abs/2512.15447

Language language

English

Depositor depositor

Swierzy, Ben

Date Of Deposit dateOfDeposit

2026-01-09

Kind Of Data kindOfData

program source code

Related Material relatedMaterial

GitHub Repository: https://github.com/BlobbyBob/AletheiaJSVersionDetection
Dolospy: https://doi.org/10.60507/FK2/F4VQRH

Related Datasets relatedDatasets

Internet Measurement Dataset: https://doi.org/10.60507/FK2/AHYGMN

Software Metadata (CodeMeta v2.0)

Development Status developmentStatus

Concept

Code Repository codeRepository

https://github.com/BlobbyBob/AletheiaJSVersionDetection

Application Category applicationCategory

Data Collection
Analysis

Application Sub Category applicationSubCategory

Web Crawling
JavaScript Static Analysis

Programming Language programmingLanguage

JavaScript
Python
C++

Runtime Platform runtimePlatform

Python 3.12
Node.js 22

Operating System operatingSystem

Linux

Build Instructions buildInstructions

https://github.com/BlobbyBob/AletheiaJSVersionDetection/tree/main/dolospy/BUILD.md

Software Requirements Item softwareRequirementsItem

Software Requirements
matplotlib 3.9.3
Software Requirements Info Url
https://matplotlib.org
Software Requirements
pandas 2.2.3
Software Requirements Info Url
https://pandas.pydata.org
Software Requirements
semantic_version 2.10.0
Software Requirements Info Url
https://github.com/rbarrois/python-semanticversion
Software Requirements
dataclass_wizard 0.28.0
Software Requirements Info Url
https://github.com/rnag/dataclass-wizard
Software Requirements
beautifulsoup4 4.12.3
Software Requirements Info Url
https://www.crummy.com/software/BeautifulSoup/bs4/
Software Requirements
requests 2.32.3
Software Requirements Info Url
https://requests.readthedocs.io
Software Requirements
@dodona/dolos-lib 3.5.1
Software Requirements Info Url
https://dolos.ugent.be
Software Requirements
source-map-js 1.2.1
Software Requirements Info Url
https://github.com/7rulnik/source-map-js
Software Requirements
acorn 8.15.0
Software Requirements Info Url
https://github.com/acornjs/acorn
Software Requirements
acorn-walk 8.3.4
Software Requirements Info Url
https://github.com/acornjs/acorn
Software Requirements
acorn-loose 8.5.2
Software Requirements Info Url
https://github.com/acornjs/acorn
Software Requirements
workerpool 10.0.1
Software Requirements Info Url
https://github.com/josdejong/workerpool
Software Requirements
astring 1.9.0
Software Requirements Info Url
https://github.com/davidbonnet/astring#readme
Software Requirements
@swc/core 1.15.8
Software Requirements Info Url
https://swc.rs
Software Requirements
pymongo 4.7.3
Software Requirements Info Url
https://www.mongodb.org
Software Requirements
tqdm 4.66.4
Software Requirements Info Url
https://tqdm.github.io

Memory Requirements memoryRequirements

20 GB (when applied to the original dataset)

Processor Requirements processorRequirements

Readme readme

https://github.com/BlobbyBob/AletheiaJSVersionDetection/blob/main/README.md

Expected crawler behaviour

Use a stable, truthful User-Agent with product/version and a working contact URL. Across all IP addresses and HTTP connections used by one crawler identity, allow no more than 5 requests in flight and wait at least 20 seconds between request starts. Crawl URLs listed in the catalog sitemap, including file pages and download URLs when they are published, use conditional requests, honor Retry-After, and apply exponential backoff after errors.

The welcome page may link to the interactive repository for human navigation. Automated clients must not treat that human link as a catalog crawl target.

Read the live machine-readable crawler policy before and during a crawl. Stop crawling when it reports CPU or memory utilization at or above 80% and 80% respectively.