17 research outputs found

    Jack-in-the-box: An Empirical Study of JavaScript Bundling on the Web and its Security Implications

    Get PDF
    In recent years, we have seen an increased interest in studying the software supply chain of user-facing applications to uncover problematic third-party dependencies. Prior work shows that web applications often rely on outdated or vulnerable third-party code. Moreover, real-world supply chain attacks show that dependencies can also be used to deliver malicious code, e.g., for carrying cryptomining operations. Nonetheless, existing measurement studies in this domain neglect an important software engineering practice: developers often merge together third-party code into a single file called bundle, which they then deliver from their own servers, making it appear as first-party code. Bundlers like Webpack or Rollup are popular open-source projects with tens of thousand of GitHub stars, suggesting that this technology is widely-used by developers. Ignoring bundling may result in underestimating the complexity of modern software supply chains. In this work, we aim to address this methodological shortcomings of prior work. To this end, we propose a novel methodology for automatically detecting bundles, and partially reverse engineer them. Using this methodology, we conduct the first large-scale empirical study of bundled code on the web and examine its security implications. We provide evidence about the high prevalence of bundles, which are contained in 40% of all websites and the average website includes more than one bundle. Following our methodology, we reidentify 1051 vulnerabilities originating from 33 vulnerable npm packages, included in bundled code. Among the vulnerabilities, we find 17 critical and 59 high severity ones, which might enable malicious actors to execute attacks such as arbitrary code execution. Analyzing the low-rated libraries included in bundles, we discover 10 security placeholder packages, which suggest that supply-chain attacks against bundles are not only possible, but they are already happening

    Constraints on the origin and evolution of Iani Chaos, Mars

    Get PDF
    [1] The origin mechanisms and geologic evolution of chaotic terrain on Mars are poorly constrained. Iani Chaos, located at the head Ares Vallis, is among the most geomorphologically complex of the chaotic terrains. Its morphology is defined by (1) multiple, 1 to 2 km deep basins, (2) flat‐topped, fractured plateaus that are remnants of highland terrain, (3) knobby, fractured remnants of highland terrain, (4) plateaus with a knobby surface morphology, (5) interchaos grooved terrain, (6) interior layered deposits (ILDs), and (7) mantling material. Topography, the observed geomorphology, and measured fracture patterns suggest that the interchaos basins formed as a result of subsurface volume loss and collapse of the crust, likely owing to effusion of groundwater to the surface. Regional patterns in fracture orientation indicate that the basins developed along linear zones of preexisting weakness in the highland crust. Multiple overlapping basins and fracture systems point to multiple stages of collapse at Iani Chaos. Furthermore, the total estimated volume loss from the basins (104 km3) is insufficient to explain erosion of 104–105 km3 of material from Ares Vallis by a single flood. Comparisons with the chronology of Ares Vallis indicate multiple water effusion events from Iani Chaos that span the Hesperian, with termination of activity in the early Amazonian. Recharge of groundwater through preexisting fracture systems may explain this long‐lived, but likely episodic, fluvial activity. Late‐stage, early to middle Amazonian aqueous processes may have deposited the ILDs. However, the topography data indicate that the ILDs did not form within lacustrine environments

    Widespread movement of meltwater onto and across Antarctic ice shelves

    Get PDF
    Surface meltwater drains across ice sheets, forming melt ponds that can trigger ice-shelf collapse, acceleration of grounded ice flow and increased sea-level rise. Numerical models of the Antarctic Ice Sheet that incorporate meltwater’s impact on ice shelves, but ignore the movement of water across the ice surface, predict a metre of global sea-level rise this century5 in response to atmospheric warming. To understand the impact of water moving across the ice surface a broad quantification of surface meltwater and its drainage is needed. Yet, despite extensive research in Greenland and observations of individual drainage systems in Antarctica, we have little understanding of Antarctic-wide surface hydrology or how it will evolve. Here we show widespread drainage of meltwater across the surface of the ice sheet through surface streams and ponds (hereafter ‘surface drainage’) as far south as 85° S and as high as 1,300 metres above sea level. Our findings are based on satellite imagery from 1973 onwards and aerial photography from 1947 onwards. Surface drainage has persisted for decades, transporting water up to 120 kilometres from grounded ice onto and across ice shelves, feeding vast melt ponds up to 80 kilometres long. Large-scale surface drainage could deliver water to areas of ice shelves vulnerable to collapse, as melt rates increase this century. While Antarctic surface melt ponds are relatively well documented on some ice shelves, we have discovered that ponds often form part of widespread, large-scale surface drainage systems. In a warming climate, enhanced surface drainage could accelerate future ice-mass loss from Antarctic, potentially via positive feedbacks between the extent of exposed rock, melting and thinning of the ice sheet

    An energy-biochar chain involving biomass gasification and rice cultivation in Northern Italy

    No full text
    The competing demand for food and bioenergy requires new solutions for the agricultural sector, which cannot be spoiled out of its fundamental role of feeding a world population continuously growing. In this context, the production of bioenergy from crop residues and residual biomass may be an interesting solution, since do not affect food production while creating energy. In particular, the gasification technology produces both energy and biochar, which seems to have positive agronomic effects in many experimental fields worldwide, also sequestering carbon in soil. However a full assessment of the energetic performances of gasification plants, as well as their impact in term of greenhouse gases (GHG), needs to be done. In this paper we complete a Life Cycle Analysis (LCA) of an advanced gasification plant located in northwestern Italy, in particular focusing on the GHG balance of the supply chain, including the field distribution of the resulting biochar in a typical paddy rice field. The results indicate that biochar has marginal, but positive effect on rice yield, not affecting soil aggregation in the short-term. Moreover, LCA suggested net emissions ranging between -0.54 and -2.1 t CO2e t-1 biochar depending on the allocation scenario adopted.JRC.H.5-Land Resources Managemen
    corecore