Why Reachability Analysis for JavaScript Is Hard (and How We Fixed It)

Endor Labs introduces an innovative approach to Software Composition Analysis (SCA) by employing call graphs to assess the reachability of vulnerabilities in third-party JavaScript dependencies, thus minimizing the false positives and negatives associated with traditional SCA methods that rely solely on manifest files. This method involves static analysis of first-party code to generate call graphs, which are then used to identify which vulnerable functions are actively used, reducing unnecessary alerts by up to 92%. The process is complicated by JavaScript's unique challenges, such as NodeJS's complex dependency resolution, module-level code execution upon import, and the use of anonymous functions and dynamic imports, all of which make it difficult to generate accurate call graphs. By focusing on function-level reachability and applying additional filters like Exploit Prediction Scoring System (EPSS), Endor Labs significantly reduces the number of vulnerabilities that developers need to address, thereby streamlining organizational vulnerability management workflows and allowing AppSec teams to prioritize critical open-source vulnerabilities efficiently.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.