Abstract: An application determines versions of a software package, and runs a test having a plurality of components on each version. The application generates a matrix of vectors, each vector corresponding to a given version of the software package and having a results cell for each component of the test, the cell populated with a result, where each vector is different. The application identifies a patch for a given version of the software package, and runs the test on the patch, the output of the test including a vector of results from the test on the patch for each component of the test. Responsive to determining that the vector of results from the test on the patch matches a given vector corresponding to the given version of the software package, the application determines that the patch is usable to patch the given version of the software package.

Abstract: Systems and methods are disclosed herein for determining reachability of vulnerable code. In some embodiments, a tool receives an alert of a vulnerability within an application, and determines a set of dependent packages by referencing a knowledge graph. For each vulnerable node of the dependency chain having the vulnerability, the tool identifies a set of node pairs having a direct link between an upstream node and the vulnerable node, determines whether the vulnerable node is reachable by each upstream node of the set of upstream nodes, and annotates links for unreachable nodes. For upstream nodes that are able to reach the vulnerable node, the tool iteratively determines whether a respective further upstream node is able to reach respective ones of their respective directly connected downstream nodes. The tool generates a pruned dependency chain by determining a boundary of the dependency chain, separating reachable vulnerable nodes from unreachable vulnerable nodes.

Abstract: In some embodiments, a tool receives a vulnerability alert, and inputs the vulnerability alert and associated code from a software package into a generative artificial intelligence model, the model primed to receive a given vulnerability alert and identify a location within the associated code having a given vulnerability pattern. The tool receives, as output from the model, a vulnerability pattern within a subset of the associated code and an explanation of why the vulnerability pattern matches the vulnerability alert. The tool performs a secondary verification that the vulnerability pattern matches the vulnerability alert, and, responsive to success of the secondary verification, performs a reachability analysis of the vulnerability pattern with respect to an application having the software package as a dependency.

Abstract: A request is received to scan a package integration for a malicious dependency, the package integration to be integrated into an application. Using a known package cache, a subset dependencies of the package integration that have not been previously scanned is determined. Content of each file of the subset is input into a malware detection model, and an identification of an ambiguous pattern is received from the malware detection model. Responsive to receiving the identification of the ambiguous pattern, the ambiguous pattern is input into a severity model, and a level of severity that the ambiguous pattern would impose on an assumption that malware is present is received. Where the level of severity is above a threshold minimum level of severity, a query is transmitted to a generative machine learning model to determine whether malware is present.

Abstract: A request is received to scan a package integration for a malicious dependency. A subset of dependencies of the package integration is determined that, if executed by an application, would be used. A known package cache is referenced to determine that at least a portion of a file of the subset was not previously scanned. A graph representation of the portion is generated, the graph representation including a tree with edges that connect the portion with one or more further dependent files that depend from the portion. The portion and its further dependent files are scanned for malware, and the known package cache is updated with the tree and with results of the scan. It is determined whether malware is within the package integration using the known package cache and the results of the scan, and an alert is output where malware is detected.