Generating Proof-of-Vulnerability Tests for Software Supply Chain Security

arXiv·medium signal

When library vulnerabilities are reachable through application code, apps become vulnerable to supply chain attacks — but developers often need concrete, executable proof before acting. This paper generates proof-of-vulnerability tests that demonstrate exploitability through application code paths, giving developers actionable evidence rather than abstract CVE reports. Directly relevant for any team running dependency scanners that flag hundreds of CVEs without context on actual reachability.