[EMSE'26] Silent Data Thieves: Investigating Malicious Data Exfiltration Packages in PyPI. [BIB]
Ye Li, Guangye Bai, Yang Shi, Kaifeng Huang. Empirical Software Engineering, accepted, 2026.
[TOSEM'26] Lifting the Veil on Composition, Risks, and Mitigations of the Large Language Model Supply Chain. [PDF][BIB]
Kaifeng Huang, Bihuan Chen, You Lu, Susheng Wu, Dingji Wang, Yiheng Huang, Haowen Jiang, Zhuotong Zhou, Junming Cao, Xin Peng. ACM Transactions on Software Engineering and Methodology, accepted, 2026.
[Internetware'26] What Static Features Reveal About Ransomware: An Empirical Study. [BIB]
Xinyu Liu, Kaifeng Huang. In Proceedings of the 17th International Conference on Internetware, Gold Coast, Australia, accepted, 2026.
[TOSEM'26] CoCoPat: Identifying Critical Changes in Vulnerability Patches. [PDF][BIB]
Susheng Wu, Yiheng Cao, Xin Hu, Zhuotong Zhou, Yijian Wu, Bihuan Chen, Ruisi Wang, Yiheng Huang, Kaifeng Huang, Xin Peng. ACM Transactions on Software Engineering and Methodology, accepted, 2026.
[ISSTA'26] TensorLock: Recovering Model Dependency for Model Supply Chain. [PDF][BIB]
Susheng Wu, Ziqian Chen, Chengyuan Li, Kaifeng Huang, Zekai Chen, Yijian Wu, Bihuan Chen, Yiheng Cao, Zhuotong Zhou, Yiheng Huang, Xin Peng. In Proceedings of the 35th ACM SIGSOFT International Symposium on Software Testing and Analysis, Oakland, CA, USA, pp. 641-643, 2026.
[LLMSC'26] Benchmarking MCP Vulnerability Detection from a Paired Evaluation Perspective. [PDF][BIB]
Zhenghao Tang, Zhenyu Zang, Kaifeng Huang. In Proceedings of the 2nd International Workshop on Large Language Model Supply Chain Analysis, Montreal, Canada, accepted, 2026.
[AAAI'26] Uncovering Pretraining Code in LLMs: A Syntax-Aware Attribution Approach. [PDF][BIB]
Yuanheng Li, Zhuoyang Chen, Xiaoyun Liu, Yuhao Wang, Mingwei Liu, Yang Shi, Kaifeng Huang, Shengjie Zhao. In Proceedings of the 40th Annual AAAI Conference on Artificial Intelligence
, Singapore, 40(1), pp. 721-729, 2026.
[USENIX Security'25] MalGuard: Towards Real-Time, Accurate, and Actionable Detection of Malicious Packages in PyPI Ecosystem. [PDF][BIB]
Xingan Gao, Xiaobing Sun, Sicong Cao, Kaifeng Huang, Di Wu, Xiaolei Liu, Xingwei Lin, Yang Xiang. In Proceedings of the 34th USENIX Security Symposium, SEATTLE, WA, United States, pp. 4741-4758, 2025.
[ICSE'25] LLMs Meet Library Evolution: Evaluating Deprecated API Usage in LLM-based Code Completion. [PDF][BIB]
Chong Wang, Kaifeng Huang, Jian Zhang, Yibo Feng, Lyuye Zhang, Yang Liu, Xin Peng. In Proceedings of the 47th IEEE/ACM International Conference on Software Engineering, Ottawa, Ontario, Canada, pp. 885-897, 2025.
[TOSEM'25] Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI using a Single Model of Malicious Behavior Sequence. [PDF][BIB]
Junan Zhang, Kaifeng Huang, Yiheng Huang, Bihuan Chen, Ruisi Wang, Chong Wang, Xin Peng. ACM Transactions on Software Engineering and Methodology, 34(4), pp. 1-28, 2025.
[CCS'24] VMUD: Detecting Recurring Vulnerabilities with Multiple Fixing Functions via Function Selection and Semantic Equivalent Statement Matching. [PDF][BIB]
Kaifeng Huang, Chenhao Lu, Yiheng Cao, Bihuan Chen, Xin Peng. In Proceedings of the 31th ACM Conference on Computer and Communications Security, Salt Lake City, United States, pp. 3958-3972, 2024.
[ASE'24] Vision: Identifying Affected Library Versions for Open Source Software Vulnerabilities. [PDF][BIB]
Susheng Wu, Ruisi Wang, Kaifeng Huang, Yiheng Cao, Wenyan Song, Zhuotong Zhou, Yiheng Huang, Bihuan Chen, Xin Peng. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, Sacramento, California, United States, pp. 1447-1459, 2024.
[ASE'24] 1+1>2: Integrating Deep Code Behaviors with Metadata Features for Malicious PyPI Package Detection. [PDF][BIB]
Xiaobing Sun, Xingan Gao, Sicong Cao, Lili Bo, Xiaoxue Wu, Kaifeng Huang. In Proceedings of the 39th IEEE/ACM International Conference on Automated Software Engineering, Sacramento, California, United States, pp. 1159-1170, 2024.
[ISSTA'24] Your "Notice" is Missing: Detecting and Fixing Violations of Modification Terms in Open Source Licenses during Forking. [PDF][BIB]
Kaifeng Huang, Yingfeng Xia, Bihuan Chen, Siyang He, Huazheng Zeng, Zhuotong Zhou, Jin Guo, Xin Peng. In Proceedings of the 33rd ACM SIGSOFT International Symposium on Software Testing and Analysis, Vienna, Austria, pp. 1022-1034, 2024.
[JOS'24] 基于静态分析的Python第三方库API兼容性问题检测方法 (Detecting Incompatible Third-Party Library APIs in Python Based on Static Analysis). [PDF][BIB]
沈阚, 黄凯锋, 陈碧欢, 彭鑫. 软件学报（Journal of Software）, 36(4), pp. 1435-1460, 2024.
[SANER'24] Enhancing Field Tracking and Interprocedural Analysis to Find More Null Pointer Exceptions. [PDF][BIB]
Dongfang Xie, Bihuan Chen, Kaifeng Huang, Yu Wang, Linghao Pan, Zhicheng Chen, Xin Peng. In Proceedings of the 31st IEEE International Conference on Software Analysis, Evolution and Reengineering, Rovaniemi, Finland, pp. 849-859, 2024.
[ICSE'24] Identifying Affected Libraries and Their Ecosystems for Open Source Software Vulnerabilities. [PDF][BIB]
Susheng Wu, Wenyan Song, Kaifeng Huang, Bihuan Chen, Xin Peng. In Proceedings of the 46th IEEE/ACM International Conference on Software Engineering, Lisbon, Portugal, pp. 162: 1-12, 2024.
[FSE'23] Demystifying Dependency Bugs in Deep Learning Stack. [PDF][BIB]
Kaifeng Huang, Bihuan Chen, Susheng Wu, Junmin Cao, Lei Ma, Xin Peng. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, San Francisco, California, United States, pp. 450-462, 2023.
[ICSME'23] Characterizing the Complexity and Its Impact on Testing in ML-Enabled Systems - A Case Study on Rasa. [PDF][BIB]
Junming Cao, Bihuan Chen, Longjie Hu, Jie Gao, Kaifeng Huang, Xin Peng. In Proceedings of the 39th IEEE International Conference on Software Maintenance and Evolution, Bogotá, Colombia, pp. 258-270, 2023.
[FSE'22] Tracking Patches for Open Source Software Vulnerabilities. [PDF][BIB]
Congying Xu, Bihuan Chen, Chenhao Lu, Kaifeng Huang, Xin Peng, Yang Liu. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Singapore, pp. 860–871, 2022.
[EMSE'22] Characterizing Usages, Updates and Risks of Third-party Libraries in Java Projects. [PDF][BIB]
Kaifeng Huang, Bihuan Chen, Congying Xu, Ying Wang, Bowen Shi, Xin Peng, Yijian Wu, Yang Liu. Empirical Software Engineering, 27.4:90, 2022.
[ASE'21] REPFINDER: Finding Replacements for Missing APIs in Library Update. [PDF][BIB]
Kaifeng Huang, Bihuan Chen, Linghao Pan, Shuai Wu, Xin Peng. In Proceedings of the 36th IEEE/ACM International Conference on Automated Software Engineering, Melbourne, Australia, pp. 266-278, 2021.
[FSE'20] Interactive, Effort-aware Library Version Harmonization. [PDF][BIB]
Kaifeng Huang, Bihuan Chen, Bowen Shi, Ying Wang, Congying Xu, Xin Peng. In Proceedings of the 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Singapore, pp. 518-529, 2020.
[ICSME'20] An Empirical Study of Usages, Updates and Risks of Third-Party Libraries in Java Projects. [PDF][BIB]
🏆IEEE TCSE Distinguished Paper Award
Ying Wang, Bihuan Chen, Kaifeng Huang, Bowen Shi, Congying Xu, Xin Peng, Yijian Wu, Yang Liu. In Proceedings of the 36th IEEE International Conference on Software Maintenance and Evolution, Adelaide, Australia, pp. 35-45, 2020.[ASE'18] Cldiff: Generating Concise Linked Code Differences. [PDF][BIB]
🏆ACM SIGSOFT Distinguished Paper Award
Kaifeng Huang, Daihong Zhou, Bihuan Chen, Ying Wang, Wenyun Zhao, Xin Peng, Yang Liu. In Proceedings of the 33rd IEEE/ACM International Conference on Automated Software Engineering, Montpellier, France, pp. 679-690, 2018.[ICSA'20] Designdiff: Continuously Modeling Software Design Difference from Code Revisions. [PDF][BIB]
Xiao Wang, Lu Xiao, Kaifeng Huang, Bihuan Chen, Yutong Zhao, Yang Liu. In Proceedings of the IEEE International Conference on Software Architecture, Salvador, Bahia, Brazil, pp. 179-190, 2020.
![[]](images/avatar-small.jpg){kind=avatar}
