Jingzheng Wu

The model context protocol (MCP) has rapidly emerged as a standard framework for integrating large language models (LLMs) with external tools and resources. However, its metadata-driven and non-deterministic tool selection mechanism introduces a previously overlooked security threat. Leveraging this weakness, we uncover the confused deputy attack , where an adversarial server with subtly manipulated metadata covertly overshadows a benign one, intercepting tool invocations without exhibiting overtly malicious behavior. To systematically study this threat, we develop Puppet , the first automated security evaluation framework that: (i) enriches benign tool descriptions through selective requirement engineering to maximize semantic expressiveness, (ii) restructures them into LLM-preferred formats using description schema transformation, and (iii) applies name prioritization to introduce complementary lexical bias. Furthermore, Puppet synthesizes valid user queries to enable systematic attack evaluation. We comprehensively evaluate Puppet across 14 models from 6 providers on 2 MCP hosts, demonstrating tool selection hijacking rates up to 90.89% and end-to-end malicious payload execution rates up to 86.46%, while remaining undetectable by representative security scanners (MCP-Scan and McpSafetyScanner), which are architecturally incapable of detecting metadata-level manipulation attacks. Counterintuitively, we find that reasoning-enabled models are significantly more vulnerable than their non-reasoning counterparts. Our findings expose a critical design-level attack surface in the MCP ecosystem and highlight the urgent need for principled security safeguards.

Measuring the function similarity to detect bugs is effective, but the statements unrelated to the bugs can impede the performance due to the noise interference. Suppressing the noise interference in existing works does not manage the tough job, i.e., eliminating the noise in the targets. In this paper, we propose MATUS to mitigate the target noise for precise bug detection based on similarity measurement. Feature slices are extracted from both the buggy query and the targets to represent the semantic feature of (potential) bug logics. In particular, MATUS guides the target slicing with the prior knowledge from the buggy code, in an end-to-end way to pinpoint the slicing criterion in the targets. All feature slices are embedded and compared based on the vector similarity. Buggy candidates are audited to confirm unknown bugs in the targets. Experiments show that MATUS holds advantages in bug detection for real-world projects with acceptable efficiency. In total, MATUS has spotted 31 unknown bugs in the Linux kernel. All of them have been confirmed by the kernel developers, and 11 have been assigned CVEs.

Using data mining to extract frequent code patterns for bug detection has proven effective. However, prior studies have overlooked the prevalence of infrequent ( rare ) patterns, even though violations of such patterns can also lead to bugs. In this paper, we present LTMiner, which mines rare patterns from large-scale projects and detects potential bugs by checking for violations of these patterns. In practice, rare patterns far outnumber frequent ones and lack strong statistical support. Consequently, we face a pattern explosion, and many rare patterns and their violations are uninteresting. LTMiner addresses this by using instance-based ranking and filtering to prioritize violations of rare patterns. It further employs a large language model (LLM) as a domain expert to audit top-ranked violations; mined information supports in-context learning, and task decomposition and self-reflection mitigate possible hallucinations. This pipeline effectively curbs pattern explosion and false positives, uncovering previously unknown bugs in large-scale projects at an acceptable cost. Applied to Linux kernel 6.12.1, LTMiner identified 42 previously unknown bugs, 27 of which have been confirmed by developers. These results indicate that, although rare-pattern bugs are sparse, a considerable number remain and exhibit a non-negligible long tail. We believe that rare-pattern bugs constitute a promising blue ocean for bug detection.

The extensive adoption of open source software (OSS) makes licensing a critical determinant of project governance, reuse, and compliance. Licenses, however, may change throughout a project’s lifecycle, and undetected modifications can introduce legal risks, ecosystem fragmentation, and community trust issues. Existing automated methods remain limited in identifying and classifying licenses, inferring change motivations, and assessing compatibility, and thus fail to meet the demands of large-scale, evolving OSS ecosystems. This paper introduces LiTracker, an Large Language Model(LLM)–based framework for automated tracking and analysis of license evolution in OSS. LiTracker integrates 3,324 licenses from SPDX and OSI, and analyzes 11.7 million commits and 3 million issues from 3,172 high-quality GitHub projects. Through domain-adaptive pretraining and supervised fine-tuning, the License-Qwen3-8B model achieves state-of-the-art F1 scores of 90.94% and 94.12% for license identification and classification. Empirical results show that 11.54% of projects experience license changes, with Java, C/C++, and Python ecosystems exhibiting the highest rates. Most changes are driven by compatibility and compliance requirements, license upgrades, or business strategy shifts. LiTracker further quantifies the compatibility risks induced by these changes: 7.38% of modified projects contain license conflicts, mainly between copyleft and permissive licenses, involving Offer Source Code, Grant Patents, and Sublicense terms. In sum, LiTracker represents the first end-to-end, LLM-driven framework for semantic analysis of license evolution, providing empirical foundations for open source governance, dependency risk control, and automated compliance support.

A Software Bill of Materials (SBOM) is a machine-readable artifact that systematically organizes software information, enhancing supply chain transparency and security. To facilitate the exchange and utilization of SBOMs, organizations such as the Linux Foundation and OWASP have proposed SBOM standards. Following standards, organizations have developed tools for generating and utilizing SBOMs. However, limited research has examined the adherence of these SBOM tools to standard specifications, a gap that could lead to compliance failures and disruptions in SBOM utilization. This paper presents the first large-scale, two-stage empirical analysis of the adherence gap, using our automated evaluation framework, SAP . The evaluation, comprising a baseline evaluation and a one-year longitudinal follow-up, covers 55,444 SBOMs generated by six SBOM tools from 3,287 real-world repositories. Our analysis reveals persistent, fundamental limitations in current SBOM tools: (1) inadequate compliance support with policy requirements; (2) poor tool consistencies, including inter-tool consistency rates as low as 7.84% to 12.77% for package detection across languages, and significant longitudinal inconsistency, where tools show low consistency with their own prior versions; and (3) mediocre to poor accuracy for detailed software information, e.g. , accuracy of package licenses below 20%. We analyze the root causes of these gaps and provide practical solutions. All the code, replication docker image, evaluation results are open sourced at GitHub and Zenodo ¹ for further researches.

To mitigate the security and compliance risks posed by Android third-party libraries (TPLs), researchers have proposed many automated detection tools aimed at accurately identifying TPLs within Android applications (apps). The detection results serve as the foundation for practical downstream tasks such as software bill of materials (SBOM) generation, n-day vulnerability identification, compliance auditing, and software supply chain risk tracing, among others. However, despite the high levels of detection accuracy and efficiency achieved by state-of-the-art TPL detection tools, existing studies lack a systematic evaluation of these tools' robustness against potential malicious attacks. As a result, the risk of detection failure in real-world scenarios remains unmanageable. Tools with poor robustness may be rendered ineffective under attack, allowing unsafe and non-compliant TPLs within apps to evade scrutiny and analysis, thereby compromising user interests. To bridge this gap, we propose the first adversarial attack against TPL detection tools, LibPass. The core idea of LibPass is to generate adversarial apps by crafting perturbations that go beyond the code transformations introduced by obfuscation techniques. These adversarial perturbations hinder the generalization capability of existing detection tools, which are primarily designed to counter code obfuscation, thereby enabling the evasion of TPL detection. To minimize attack overhead and enhance stealthiness, LibPass employs an improved firefly algorithm to search for optimal adversarial apps. This work evaluates the effectiveness of LibPass against five state-of-the-art TPL detection tools on three datasets of different types and benchmarks its performance against three baseline attack methods. Experimental results demonstrate that LibPass achieves an average attack success rate of 61.33%, with a peak of 99.46%, underscoring the insufficient robustness of current TPL detection tools.

Software repositories such as PyPI and npm are vital for software development but expose users to serious security risks from malicious packages. The malicious packages often execute their payloads immediately upon installation, leading to rapid system compromise. Existing detection methods are heavily dependent on difficult-to-obtain explicit knowledge, rendering them susceptible to overlooking emergent malicious packages. In this paper, we present a lightweight and effective method, namely EMPHunter, to detect malicious packages without requiring any explicit prior knowledge. EMPHunter is founded upon two fundamental and insightful observations. First, malicious packages are considerably rarer than benign ones, and second, the functionality of installation scripts for malicious packages diverges significantly from those of benign packages, with the latter frequently forming clusters. Consequently, EMPHunter utilizes the clustering technique to group the unique installation scripts of new-uploaded packages and identifies outliers as candidate malicious packages. It then ranks the outliers according to their deviate degrees and the distance between each of them and known malicious instances, effectively highlighting potential malicious packages. With EMPHunter, we successfully identified 122 previously unknown malicious packages from a pool of 267,009 newly-uploaded PyPI and npm packages, achieving an mAP (Mean Average Precision) of 0.813 and an exceptional recall of 0.992 when auditing the top-10 rankings. All detected packages have been officially confirmed as genuine malicious package by PyPI and npm. We assert that EMPHunter offers a valuable and advantageous supplement to existing detection tools, augmenting the arsenal of software supply chain security analysis.