Silent but Deadly: Reconstructing Undisclosed Security Vulnerabilities in Public Package Registries (god2026)

Research shows that up to 50% of security fixes in open source repositories are committed silently — no CVE, no advisory, no changelog entry — and more than 10% have active exploits in the wild before anyone outside the project knows (Li & Paxson, CCS 2017; Dong et al., DSN 2025). Traditional detection techniques like binary patch classifiers... Weiterlesen