LLMVD.js: AI Agent Pipeline for Node.js Vulnerability Detection

A new multi-stage agent pipeline called LLMVD.js uses large language models (LLMs) and tool-augmented reasoning to detect and confirm taint-style vulnerabilities, such as arbitrary command injection, in Node.js packages. The approach addresses challenges posed by dynamic JavaScript features and extensive package dependencies, which traditional program analysis struggles with. The pipeline scans code, proposes vulnerabilities, generates proof-of-concept exploits, and validates them through lightweight execution oracles. The research is detailed in a paper on arXiv (2604.20179v1), highlighting the potential of LLM-centric methods for software supply chain security.