nodeshield/CITATION.cff at main · KTH-LangSec/nodeshield · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
cff-version: 1.2.0
title: "NodeShield: Runtime Enforcement of Security-Enhanced SBOMs for Node.js"
authors:
  - family-names: Cornelissen
    given-names: Eric
    orcid: "https://orcid.org/0009-0000-8376-6287"
  - family-names: Balliu
    given-names: Musard
    orcid: "https://orcid.org/0000-0001-6005-5992"
identifiers:
  - type: doi
    value: 10.1145/3719027.3765136
    description: Paper
  - type: doi
    value: 10.5281/zenodo.16873448
    description: Software
repository-code: "https://github.com/KTH-LangSec/nodeshield"
abstract: >-
  The software supply chain is an increasingly common attack
  vector for malicious actors. The Node.js ecosystem has
  been subject to a wide array of attacks, likely due to its
  size and prevalence. To counter such attacks, the research
  community and practitioners have proposed a range of
  static and dynamic mechanisms, including process- and
  language-level sandboxing, permission systems, and taint
  tracking. Drawing on valuable insight from these works,
  this paper studies a runtime protection mechanism for (the
  supply chain of) Node.js applications with the ambitious
  goals of compatibility, automation, minimal overhead, and
  policy conciseness.


  Specifically, we design, implement and evaluate
  NodeShield, a protection mechanism for Node.js that
  enforces an application's dependency hierarchy and
  controls access to system resources at runtime. We
  leverage the up-and-coming SBOM standard as the source of
  truth for the dependency hierarchy of the application,
  thus preventing components from stealthily abusing
  undeclared components. We propose to enhance the SBOM with
  a notion of capabilities that represents a set of related
  system resources a component may access. Our proposed SBOM
  extension, the Capability Bill of Materials or CBOM,
  records the required capabilities of each component,
  providing valuable insight into the potential privileged
  behavior. NodeShield enforces the SBOM and CBOM at runtime
  via code outlining (as opposed to inlining) with no
  modifications to the original code or Node.js runtime,
  thus preventing unexpected, potentially malicious
  behavior. Our evaluation shows that NodeShield can prevent
  over 98% out of 67 known supply chain attacks while
  incurring minimal overhead on servers at less than 1ms per
  request. We achieve this while maintaining broad
  compatibility with vanilla Node.js and a concise policy
  language that consists of at most 7 entries per
  dependency.
keywords:
  - Web Application Security
  - Web Security
  - Supply Chain Security
  - Node.js
  - SBOM
license: BSD-2-Clause-Patent
version: 1.0.0
date-released: "2025-10-13"
preferred-citation:
  type: conference-paper
  authors:
    - family-names: Cornelissen
      given-names: Eric
      orcid: "https://orcid.org/0009-0000-8376-6287"
    - family-names: Balliu
      given-names: Musard
      orcid: "https://orcid.org/0000-0001-6005-5992"
  title: "NodeShield: Runtime Enforcement of Security-Enhanced SBOMs for Node.js"
  conference:
    name: ACM SIGSAC Conference on Computer and Communications Security
    location: Taipei International Convention Center (TICC)
    address: "No. 1, Section 5, Xinyi Rd, Xinyi District"
    city: Taipei City
    region: Taiwan
    post-code: 11049
    date-start: "2025-10-13"
    date-end: "2025-10-17"