Publications

2026

• What’s in a Package? Getting Visibility Into Dependencies Using Security-Sensitive API Calls First author arxiv Paper
• Chrono-Resolution: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages First author ICSME 2026 Tool Demonstration and Data Showcase Track Paper Dataset Conference Page
• How Quickly Do Development Teams Update Their Vulnerable Dependencies? First author arxiv Paper Code

2025

• Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating? First author 40th IEEE/ACM International Conference on Automated Software Engineering, ASE 2025 Paper Slides Video Conference Page
• Relative Positioning Based Code Chunking Method For Rich Context Retrieval In Repository Level Code Completion Task With Code Language Model First author Context Collection Workshop 2025 (co-located with ASE 2025) Paper Code
• Research Directions in Software Supply Chain Security ACM Transactions on Software Engineering and Methodology Paper Open Access
• If you cannot Measure it, you cannot Secure it: A Case Study on Metrics for Informed Choice of Security Controls Journal of Information Security and Applications Paper Code
• S3C2 Summit 2024-09: Industry Secure Software Supply Chain Summit First author arxiv Paper
• Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem arxiv Paper

2024

• Towards a Taxonomy of Challenges in Security Control Implementation 2024 Annual Computer Security Applications Conference (ACSAC) Paper Slides

2023

• SecureImgStego: A Keyed Shuffling-based Deep Learning Model for Secure Image Steganography 2023 IEEE Conference on Communications and Network Security (CNS) Paper Slides Code