Supply Chain Security Metrics
Aid practitioners to identify secure software products in software ecosystem
The goal of this research is to aid practitioners in producing more secure software products through the development of actionable security metrics, the identification of weak link signals, and the leveraging of software security measures in dependency graphs to select good components.
Research contributions
-
Identify weak links signals in the npm dependency graph.
-
An automated code review workflow powered by Large Language Models (LLMs) for detecting malicious packages.
-
Empirical evaluation of open-source software to identify actionable security practice metrics.
-
Model to identify which security practices are most important to understand the relationship between security practices and security outcome metrics.
Related publications
2025
-
IEEE/ACM International Conference on Automated Software Engineering (ASE)
