Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web" (doi:10.60507/FK2/F4VQRH)

View:

Part 1: Document Description
Part 2: Study Description
Part 5: Other Study-Related Materials
Entire Codebook

Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web"

doi:10.60507/FK2/F4VQRH

bonndata

2026-01-22

1

Swierzy, Ben, 2026, "Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web"", https://doi.org/10.60507/FK2/F4VQRH, bonndata, V1

Replication Software for "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web"

doi:10.60507/FK2/F4VQRH

Swierzy, Ben (University of Bonn)

bonndata

Swierzy, Ben

Swierzy, Ben

2026-01-09

https://doi.org/10.60507/FK2/F4VQRH

Computer and Information Science

This dataset contains software artifacts for the paper "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web". It includes all software artifacts (crawler, Aletheia implementation, evaluation scripts) used for analysis. For the re-implementation of Dolos (dolospy), please check the related material.

program source code

<a href="https://mit-license.org/">MIT</a>

GitHub Repository: https://github.com/BlobbyBob/AletheiaJSVersionDetection

Dolospy: https://doi.org/10.60507/FK2/F4VQRH

Internet Measurement Dataset: https://doi.org/10.60507/FK2/AHYGMN

Ben Swierzy, Marc Ohm, and Michael Meier. 2026. Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web. In 2026 IEEE/ACM 48th International Conference on Software Engineering (ICSE ’26), April 12–18, 2026, Rio de Janeiro, Brazil. ACM, New York, NY, USA, 13 pages. https://doi.org/10.1145/3744916.3787780

10.1145/3744916.3787780

Ben Swierzy, Marc Ohm, and Michael Meier. 2026. Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web. In 2026 IEEE/ACM 48th International Conference on Software Engineering (ICSE ’26), April 12–18, 2026, Rio de Janeiro, Brazil. ACM, New York, NY, USA, 13 pages. https://doi.org/10.1145/3744916.3787780

Swierzy, Ben, Marc Ohm, and Michael Meier. "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web." arXiv preprint arXiv:2512.15447 (2025).

10.48550/arXiv.2512.15447

Swierzy, Ben, Marc Ohm, and Michael Meier. "Insecure Ingredients? Exploring Dependency Update Patterns of Bundled JavaScript Packages on the Web." arXiv preprint arXiv:2512.15447 (2025).

Label:

readme.txt

text/plain

Label:

USAGE.md

text/markdown

Label:

docker-compose.yml

application/yaml

Label:

rabbitmq.conf

text/plain

Label:

bundlefetcher-stealth.py

text/x-python

Label:

Dockerfile

application/x-docker-file

Label:

puppeteer.mjs

application/x-javascript

Label:

requirements.txt

text/plain

Label:

Dockerfile

application/x-docker-file

Label:

domainlist.py

text/x-python

Label:

requirements.txt

text/plain

Label:

Dockerfile

application/x-docker-file

Label:

entrypoint.sh

application/x-shellscript

Label:

hev.yml

application/yaml

Label:

Dockerfile

application/x-docker-file

Label:

object-storage.py

text/x-python

Label:

requirements.txt

text/plain

Label:

pyproject.toml

application/toml

Label:

__init__.py

text/x-python

Label:

Dockerfile

application/x-docker-file

Label:

requirements.txt

text/plain

Label:

separating-collector.py

text/x-python

Label:

Dockerfile

application/x-docker-file

Label:

requirements.txt

text/plain

Label:

throttle.py

text/x-python

Label:

bundler-prevalence.ipynb

application/x-ipynb+json

Label:

cdn-urls.ipynb

application/x-ipynb+json

Label:

common.py

text/x-python

Label:

lab-aletheia.ipynb

application/x-ipynb+json

Label:

lab-bundler-study.ipynb

application/x-ipynb+json

Label:

real-aletheia.ipynb

application/x-ipynb+json

Label:

real-bundler-study.ipynb

application/x-ipynb+json

Label:

update-patterns-aletheia.ipynb

application/x-ipynb+json

Label:

update-patterns-cdn.ipynb

application/x-ipynb+json

Label:

update-patterns-pnpm.ipynb

application/x-ipynb+json

Label:

aletheia_speed_eval.py

text/x-python

Label:

aletheia_speed_eval_real_vd.py

text/x-python

Label:

aletheia_speed_eval_recover.py

text/x-python

Label:

analyze_bundle_dataset.py

text/x-python

Label:

biome.json

application/json

Label:

bun-serve.mjs

application/x-javascript

Label:

file-selection.pdf

application/pdf

Label:

file-selector.mjs

application/x-javascript

Label:

generate_bundles.py

text/x-python

Label:

local_version_fetcher.py

text/x-python

Label:

npm_mirror.py

text/x-python

Label:

package.json

application/json

Label:

pack_bundles.py

text/x-python

Label:

vulnerability-database.py

text/x-python

Label:

aletheia-preprocessor.mjs

application/x-javascript

Label:

aletheia-preprocessor.worker.mjs

application/x-javascript

Label:

aletheia-serializer.mjs

application/x-javascript

Label:

identify.mjs

application/x-javascript

Label:

identify_bundler.mjs

application/x-javascript

Label:

identify_compartments.mjs

application/x-javascript

Label:

utils.mjs

application/x-javascript