Short-Lived Malicious Releases in Package Ecosystems

The thesis: build empirically defensible signals for npm supply-chain risk. Software ecosystems publish thousands of packages a day; the field needs reproducible methodology, not vibes-based reputation scoring. My research is structured around three workstreams that each test a different signal.

Workstream 1 — TypeScript static analysis. A Dockerized pipeline using the TypeScript Compiler API to classify errors across npm packages under varying compiler strictness. The headline finding: a 95.8% error reduction from strict → relaxed configurations, with 40 packages clean across every configuration tried.

Workstream 2 — npm-test as a benchmark. Is `npm test` a meaningful proxy for package health? CPU sampling said inconclusive (62% of corpus showed `package_ms=0` — sampling rate too coarse). We pivoted to start-to-stop wall-clock timing plus AppMap-based deterministic per-function instrumentation, which catches the long tail of sub-ms calls the V8 sampler misses.

Workstream 3 — Malicious-release dataset. A frozen v1 of confirmed npm / PyPI / NuGet supply-chain incidents spanning 2018–2026, methodologically defended (every malware window is exact: post-mortem citation, detection-timeline bound, or explicitly blank). Feeds a pilot report on whether time-based update delays reduce hijack exposure.