Vulnerability Functions Research Articles

Flood fragility and vulnerability functions for residential buildings in the Province of Leyte, Philippines

AbstractThe Philippines experiences frequent flooding, but, despite expansive tools for risk reduction, there remain gaps in understanding generalised relationships between flood events and damage to residential structures for regions outside the nation's capital. This gap has limited the ability to model flood risk and damage without robust functions to link hazards and housing vulnerability. This research draws on 394 household surveys to empirically derive a suite of flood fragility and vulnerability functions for residential structures in the Province of Leyte for light material, elevated light material and masonry structures. The results showed that masonry construction was more resilient to floods compared to light material counterparts. Elevated light material structures also exhibited lower damages at low inundations but tend to fail abruptly at flood depths greater than 3 m. By empirically deriving flood damage functions, the findings contribute to a more localised approach to quantifying housing vulnerability and risk that can be used for catastrophe and risk modelling, with applications for government agencies, the insurance industry and disaster risk researchers. This research lays the foundation for future flood risk mapping with growing significance under climate change.

Development of a regionally consistent and fully probabilistic earthquake risk model for Central Asia

Abstract. A fully probabilistic earthquake risk model was developed for five countries in Central Asia, providing updated earthquake loss estimates with a higher level of detail on all components with respect to previous studies in the region. Additionally, a regionally consistent approach that, on the one hand, allows for direct comparisons at different disaggregation levels (e.g., country and oblast) was used. On the other hand, this updated earthquake risk assessment aims to facilitate initiating a policy dialogue regarding national and regional disaster risk financing and insurance applications. This earthquake risk model made use of a regional probabilistic seismic hazard analysis and a comprehensive exposure database on which different types of assets and sectors were included and for which two scenarios (the years 2020 and 2080) were modeled. For each type of asset, a unique vulnerability function was derived and later used for convolution with the hazard data, which allowed for the estimation of the loss exceedance curve, at different disaggregation levels, from where other risk metrics such as the average annual loss (AAL) and specific return period losses were obtained. The regional earthquake AAL for the five countries and for the 2020 exposure scenario has been estimated to be around USD 2 billion, with the Kyrgyz Republic and Tajikistan being the countries with the highest earthquake risk levels in the region. Besides the probabilistic earthquake risk results, as-if scenarios were modeled using a pseudo-deterministic approach to assess the human and economic losses for realistic and representative earthquakes for the main cities within earthquake-prone regions in the five countries of the study area.

Rapid remote volcanic ashfall impact assessment for the 2022 eruption of Hunga volcano, Tonga: a bespoke approach and lessons identified

When disasters occur, rapid impact assessments are required to prioritise response actions, support in-country efforts and inform the mobilisation of aid. The 15 January 2022 eruption of Hunga volcano, Tonga, and the resulting atmospheric shockwave, ashfall, underwater mass disturbance and tsunami, caused substantial impacts across the Kingdom of Tonga. Volcanic impacts on the scale observed after the eruption are rare, necessitating a reliance on international advice and assistance. The situation was complicated by the loss of Tonga’s international submarine fibreoptic cable (causing a complete loss of communications for approximately 20 days) along with border closures due to the COVID-19 pandemic. A need emerged for a rapid remote volcanic impact assessment and provision of specialist advice to help inform the response of international partners. Here we present a novel methodology for conducting rapid remote volcanic ashfall impact assessments, conducted over a 10-day period following the eruption. We used three different hazard models for ashfall thickness across the main island of Tongatapu and available asset information and vulnerability functions for buildings, agriculture, electricity networks, water supply and roads, to provide initial estimates of losses due to ashfall from the 15 January eruption. For buildings, we estimated losses both as total losses and as percentages of the total replacement cost of buildings on Tongatapu. For agriculture, we made probabilistic estimates of production losses for three different crop classes. For ashfall clean-up, we estimated ranges of ashfall volumes requiring clean-up from road surfaces and roofs. For water supply, electricity networks and roads, our analysis was limited to assessing the exposure of important assets to ashfall, as we had insufficient information on system configurations to take the analysis further. Key constraints on our analysis were the limited nature of critical infrastructure asset inventories and the lack of volcanic vulnerability models for tropical regions including Pacific Island nations. Key steps towards iteratively improving rapid remote impact assessments will include developing vulnerability functions for tropical environments as well as ground-truthing estimated losses from remote approaches against in-person impact assessment campaigns.

Physical Vulnerability and Landslide Risk Assessment in Tegucigalpa City, Honduras

Quantitative disaster risk studies for slow-moving rotational and translational landslides in small regions (e.g., cities and watersheds) are very scarce. The limitations of risk modeling associated with these hazards include (i) the lack of data for physical modeling, (ii) methodological restrictions on estimating landslide intensity with statistical models and determining the temporal probability of landslides, and (iii) the absence of characterizations of the physical vulnerability of exposed assets. The present study combines and updates different methodologies to overcome these limitations for quantitative landslide disaster risk estimation, creating a novel methodological approach that was applied in a pilot study in Tegucigalpa city, Honduras. Tegucigalpa, the capital city of Honduras, has the highest number of recorded landslides in the country. In a previous study, landslides were found to be mainly concentrated in areas with colluvium and residual soils. As an input for the disaster risk assessment, this study generated landslide risk vulnerability functions based on empirical data. The application of the proposed methodology allowed us to estimate the average annual loss (AAL) caused by landslides in the study area—a key disaster risk metric that is lacking in other landslide disaster risk studies—enabling comparisons with disaster risk estimates associated with other hazards. In particular, the AAL value obtained for the study region was USD 7.26 million.

Ternary photocatalyst Bi5O7I/Bi2O2CO3/Ag2CO3 with double Z-scheme heterojunction for the degradation of levofloxacin under visible light: Practical application and DFT calculation

A novel double Z-scheme heterojunction Bi5O7I/Bi2O2CO3/Ag2CO3 was constructed by a simple hydrothermal calcination and one-step in-situ growth technique, demonstrating efficient levofloxacin degradation (86.9 % in 60 min). The degradation rates of the system are 1.5, 4.1, 1.3 and 1.4 times faster than those of pure Bi5O7I, Bi2O2CO3, Ag2CO3 and binary Bi5O7I/Bi2O2CO3, respectively. The method enhances the photocatalyst performance through improving the separation efficiency of electron-hole pairs (e-/h+) and the production of various free radicals in the double Z-scheme system. The generation of hydroxyl radicals (•OH), superoxide radicals (•O2–) and holes (h+) species were directly confirmed by Electron Spin Resonance test, and their contributions on the degradation of Levofloxacin follow the order of h+ > •OH > •O2–. The band structure, density of states, work function and potential sites of contaminant vulnerability in the material were determined by Density Functional Theory (DFT), which provides additional evidence for the formation of double Z-scheme heterojunction. Besides, the degradation experiment was conducted with four real surface water bodies, including lake water, river water, tap water and effluent of sewage treatment plant. The results show that the degradation rate for Levofloxacin reaches 60∼80 %. Moreover, Levofloxacin and its intermediate products were identified and their toxicity was predicted with Quantitative Structure-Activity Relationship (QSAR) modelling, which can be useful in the future for the actual design of a double Z-scheme heterojunction photocatalyst to efficiently remove pollutants under visible light irradiation.

A database of shake-table tests conducted on unreinforced masonry buildings

Experimental results obtained from shake-table tests on complete unreinforced masonry buildings (URM) play a crucial role in enhancing modeling techniques and reducing uncertainties in seismic assessments for this type of building. This paper presents an open-access database comprising 69 shake-table tests on URM buildings with a scale equal to or larger than 1:4 that have been documented in the literature. The database summarizes important geometric parameters, structural characteristics, and experimental results, including maximum shake-table accelerations, story drifts, and evolution of dynamic properties, as well as qualitative information such as observed failure modes and damage progression throughout the experiments. This database is meant to serve the research community as a resource for planning future experimental campaigns, benchmarking numerical models, validating analysis methods, and improving predictive capabilities. As an example application, we generate vulnerability functions (fragility curves) from the experimental data. Our findings reveal that buildings tested in experiments are less vulnerable compared to real buildings, particularly when severe damage is observed and when the ground motion intensity is low to moderate. The ultimate objective is to facilitate the exchange of experimental data and boost collaborative approaches in the seismic assessment of URM buildings.

Diversity, functional redundancy, and vulnerability of reef fish communities of the Saudi Arabian coast, in the northern Red Sea

In light of the current development of several giga-projects along the Saudi Red Sea coast, understanding the health status of coral reefs is paramount to developing baselines and management strategies to minimize the human impact on these ecosystems. Here, we present an assessment of the diversity, functional redundancy, and vulnerability for coral reef fish communities in the northern Red Sea. The focus area of our study falls within the marine jurisdiction of the NEOM giga-project. We performed fish surveys with three different methods aiming to cover a wide set of habitats and thus capture a comprehensive picture of the regional diversity: i) standardized belt transects, ii) roving diviersity surveys, and iii) collection of cryptobenthic fish. Our results showed a highly variable community composition along the ten surveyed sites highlighting Sindalah as an essential site for piscivore species, Al Muwaileh as an important site for herbivores, and Sanafir-Tiran as the most diverse site. Functional diversity analysis revealed similar levels of redundancy, over-redundancy, and vulnerability among sites. Functional richness, evenness, and divergence did not vary substantially between sites and, in general, indicated that the fish communities in the selected sites present mid to low levels of functional diversity. We further compare regional-scale and site-specific functional assessments. Notably, some of the species groups that are functionally redundant at the regional scale represented vulnerable functions at the site level. These results call to attention the need to create site-specific conservation strategies and not to solely rely on regional diviersity assessments as the basis for management decisions.

Advancing the understanding of earthquake risk in Portugal

The assessment of earthquake risk at the national scale is crucial for the design and implementation of risk reduction measures. Due to its location in the southwest of the Eurasian plate, Portugal is exposed to moderate to strong seismic events, such as the well-known 1755 Lisbon earthquake. We reviewed existing studies covering exposure, seismic hazard, vulnerability, and risk assessment for Portugal, and performed probabilistic seismic hazard and risk analyses for the country using new model components. These include a new exposure model developed for the residential building stock using the 2021 national Building Census Survey, a recent exposure model for commercial and industrial buildings, updated vulnerability functions for 116 building classes, and the recently released European Probabilistic Seismic Hazard model. The seismic risk results include average annual economic losses, fatalities, buildings with complete damage, and population left homeless. These results allowed the identification of the regions in Portugal with the highest earthquake risk, as well as which building classes contribute the most to the overall impact.

Analytical vulnerability functions for assessing fatalities in masonry buildings

AbstractThe assessment of human losses and injuries due to earthquakes is critical for the development of risk reduction measures. Yet, most vulnerability studies have focused on the derivation of fragility functions for structural damage, neglecting the evaluation of the human impact. In this study, we implemented a fatality vulnerability assessment procedure based on advanced structural modelling, with an application to typical limestone and granite masonry buildings in Portugal. We performed nonlinear time‐history analysis on 3D numerical models whose characteristics were sampled from statistical models representing the geometric and mechanical properties of this type of construction. Engineering demand parameters, such as volume of loss and volume of survivable space, were estimated and converted into a fatality rate based on observations from past fatal earthquakes. We compared these vulnerability functions with other proposals from the literature in which conventional fragility functions are directly combined with collapse and fatality rates. Finally, the resulting vulnerability functions were tested for two earthquake scenarios for Portugal. The results from this study indicate that the conventional approach for fatality modelling tends to underestimate human losses for strong ground shaking due to the inability to account for catastrophic structural collapses. The fatality vulnerability functions developed in this work can be directly used in probabilistic seismic risk analysis or the assessment of earthquake scenarios.

Heterogeneous effects of increased availability of alcohol on hospitalisation due to external causes. Quasi-experimental evidence from the introduction of Saturday opening at Swedish alcohol retail stores.

Responses to increased alcohol availability may vary across the population as a function of differential vulnerability. This study therefore aimed to examine the effects of the implementation of Saturday opening at the Swedish alcohol retail monopoly in 2000 on risks of hospitalisation due to external causes (HEC) among different population subgroups. Leveraging the experimental design of the reform, longitudinal difference-in-differences analyses were applied to a register-based cohort of individuals aged 20-40 at the time of implementation. The population was stratified into groups of Swedish, Finnish, and Middle Eastern origin, known to represent different levels of alcohol consumption and rates of alcohol-related morbidity. Results showed a 17.7% increase (p<0.029) in the risk of HEC among individuals of Finnish origin, as jointly caused by both increased prevalence in the experiment area and decreased prevalence in the control area. The increase was primarily driven by younger men with lower levels of education. Those of Swedish origin exhibited largely similar patterns (9.7% increase; p<0.001) while no measurable impact was observed among individuals of Middle Eastern origin (-21.4% decrease; p<0.076). The findings confirm that increasing alcohol availability contributes to the disease burden related to alcohol among population subgroups already susceptible to its effects.

Hemi-diaphragm detection of chest X-ray images based on convolutional neural network and graphics.

Chest X-rays (CXR) are widely used to facilitate the diagnosis and treatment of critically ill and emergency patients in clinical practice. Accurate hemi-diaphragm detection based on postero-anterior (P-A) CXR images is crucial for the diaphragm function assessment of critically ill and emergency patients to provide precision healthcare for these vulnerable populations. Therefore, an effective and accurate hemi-diaphragm detection method for P-A CXR images is urgently developed to assess these vulnerable populations' diaphragm function. Based on the above, this paper proposes an effective hemi-diaphragm detection method for P-A CXR images based on the convolutional neural network (CNN) and graphics. First, we develop a robust and standard CNN model of pathological lungs trained by human P-A CXR images of normal and abnormal cases with multiple lung diseases to extract lung fields from P-A CXR images. Second, we propose a novel localization method of the cardiophrenic angle based on the two-dimensional projection morphology of the left and right lungs by graphics for detecting the hemi-diaphragm. The mean errors of the four key hemi-diaphragm points in the lung field mask images abstracted from static P-A CXR images based on five different segmentation models are 9.05, 7.19, 7.92, 7.27, and 6.73 pixels, respectively. Besides, the results also show that the mean errors of these four key hemi-diaphragm points in the lung field mask images abstracted from dynamic P-A CXR images based on these segmentation models are 5.50, 7.07, 4.43, 4.74, and 6.24 pixels,respectively. Our proposed hemi-diaphragm detection method can effectively perform hemi-diaphragm detection and may become an effective tool to assess these vulnerable populations' diaphragm function for precision healthcare.

Improving VulRepair’s Perfect Prediction by Leveraging the LION Optimizer

In current software applications, numerous vulnerabilities may be present. Attackers attempt to exploit these vulnerabilities, leading to security breaches, unauthorized entry, data theft, or the incapacitation of computer systems. Instead of addressing software or hardware vulnerabilities at a later stage, it is better to address them immediately or during the development phase. Tools such as AIBugHunter provide solutions designed to tackle software issues by predicting, categorizing, and fixing coding vulnerabilities. Essentially, developers can see where their code is susceptible to attacks and obtain details about the nature and severity of these vulnerabilities. AIBugHunter incorporates VulRepair to detect and repair vulnerabilities. VulRepair currently predicts patches for vulnerable functions at 44%. To be truly effective, this number needs to be increased. This study examines VulRepair to see whether the 44% perfect prediction can be increased. VulRepair is based on T5 and uses both natural language and programming languages during its pretraining phase, along with byte pair encoding. T5 is a text-to-text transfer transformer model with an encoder and decoder as part of its neural network. It outperforms other models such as VRepair and CodeBERT. However, the hyperparameters may not be optimized due to the development of new optimizers. We reviewed a deep neural network (DNN) optimizer developed by Google in 2023. This optimizer, the Evolved Sign Momentum (LION), is available in PyTorch. We applied LION to VulRepair and tested its influence on the hyperparameters. After adjusting the hyperparameters, we obtained a 56% perfect prediction, which exceeds the value of the VulRepair report of 44%. This means that VulRepair can repair more vulnerabilities and avoid more attacks. As far as we know, our approach utilizing an alternative to AdamW, the standard optimizer, has not been previously applied to enhance VulRepair and similar models.

Exposure and seismic vulnerability of masonry buildings grouped in aggregate of a typical historical centre in the Basilicata region of Italy

The proposed study focuses on the typological and structural characterization of masonry building aggregates located in the historical centre of Atella, a small town in the district of Potenza in the Basilicata region of Italy. The data regarding building exposure were collected using the CARTIS form in the framework of Working Package 2 “Inventory of existing structural typologies” of the Italian DPC-ReLUIS project, which relates to the predominant structural taxonomies identified on-site. Subsequently, the surveyed structural information was used to carry out a preliminary vulnerability and damage analysis for the investigated urban area. Finally, the main outcomes of the study were provided in terms of the Building Typology Matrix (BTM) vulnerability functions, emphasising the differences in terms of expected susceptibility to damage of the identified CARTIS typologies.

A Study on The Heterogeneity of Tropical Cyclone Vulnerability Functions in Different Provinces along The Coastal Areas in China

Coastal regions in China have long been plagued by tropical cyclone (TC) disasters, and TC vulnerability function for disaster-bearing bodies is a widely used quantitative vulnerability assessment method in face of TCs. TC vulnerability functions may vary across different regions due to geographical heterogeneity, hindering this method from universal use. This study systematically collects a 15-year-long dataset from 12 provinces in China. Six alternative TC vulnerability functions are comprehensively investigated by province, and a library of the optimal TC vulnerability functions for three kinds of disaster-bearing bodies, that is, economic, population, and crop in different provinces is developed. The heterogeneity of TC vulnerability in different provinces along the coastal areas in China is then thoroughly analyzed. This paper provides a deeper understanding of the spatial heterogeneity characteristics of disasters and disaster-bearing bodies, and provides good references for local departments to carry out more targeted disaster prevention and reduction work.

On the utility of story loss functions for regional seismic vulnerability modeling and risk assessment

Vulnerability functions relate loss to seismic intensity and can be developed via several approaches. They are a fundamental part of seismic risk assessment on a regional level and support decision-making and intervention strategies aimed at reducing risk. This article discusses a prominent analytical approach to developing seismic vulnerability models for buildings based on equivalent single-degree-of-freedom (SDOF) modeling, fragility function, and damage-to-loss model integration. The fundamental assumptions are scrutinized, and their principal drawbacks are highlighted. An alternative approach also based on an equivalent SDOF modeling approach is discussed but instead capitalizes on story loss functions (SLFs) as a means to more accurately compute economic losses and their sources. The main benefit is that the contribution of floor acceleration-based losses can be directly considered, and the disaggregation of losses is fully represented. A case study comparison is presented to highlight the similarities and key benefits. It is seen that the SLF-based approach can provide a much more comprehensive means to compute and communicate loss contributions among different element groups (i.e., structural, non-structural, and contents) and individual stories along the building height. Existing models can simply be adjusted to this approach and provide a more holistic view of risk. The benefits and potential applications in the (re)insurance sector are also discussed.

Seismic resilience evaluation of granular column-supported road embankments on liquefiable soils

In this study, the seismic resilience of granular column-supported road embankments on liquefiable soils is examined to enhance the understanding and seismic design of resilient transportation infrastructure. A nonlinear dynamic analysis of embankments on liquefiable soils is performed, and the results are validated against centrifuge test data. In the assessment, a functional analysis framework encompassing fragility, vulnerability, and restoration functions is employed to evaluate the robustness and recovery of embankments. The resilience of embankments is quantified by the comprehensive life-cycle resilience index (R), which considers various factors, such as the embankment height, the liquefiable soil thickness, and the area replacement ratio (AR) of granular columns. A simplified design method is proposed that involves a model for rapidly assessing the resilience state of embankments under varying seismic intensities. The analysis highlights the essential role of granular columns in mitigating liquefaction-induced damage during seismic events, improving robustness, and recovering post-earthquake functionality, and a practical and reliable tool is developed for assessing embankment resilience across diverse seismic scenarios.

Vulnerable JavaScript functions detection using stacking of convolutional neural networks.

System security for web-based applications is paramount, and for the avoidance of possible cyberattacks it is important to detect vulnerable JavaScript functions. Developers and security analysts have long relied upon static analysis to investigate vulnerabilities and faults within programs. Static analysis tools are used for analyzing a program's source code and identifying sections of code that need to be further examined by a human analyst. This article suggests a new approach for identifying vulnerable code in JavaScript programs by using ensemble of convolutional neural networks (CNNs) models. These models use vulnerable information and code features to detect related vulnerable code. For identifying different vulnerabilities in JavaScript functions, an approach has been tested which involves the stacking of CNNs with misbalancing, random under sampler, and random over sampler. Our approach uses these CNNs to detect vulnerable code and improve upon current techniques' limitations. Previous research has introduced several approaches to identify vulnerable code in JavaScript programs, but often have their own limitations such as low accuracy rates and high false-positive or false-negative results. Our approach addresses this by using the power of convolutional neural networks and is proven to be highly effective in the detection of vulnerable functions that could be used by cybercriminals. The stacked CNN approach has an approximately 98% accuracy, proving its robustness and usability in real-world scenarios. To evaluate its efficacy, the proposed method is trained using publicly available JavaScript blocks, and the results are assessed using various performance metrics. The research offers a valuable insight into better ways to protect web-based applications and systems from potential threats, leading to a safer online environment for all.

Assessing the Effectiveness and Security Implications of AI Code Generators

Students, especially those outside the field of cybersecurity, are increasingly turning to Large Language Model (LLM)-based generative AI tools for coding assistance. These AI code generators provide valuable support to developers by generating code based on provided input and instructions. However, the quality and accuracy of the generated code can vary, depending on factors such as task complexity, the clarity of instructions, and the model’s familiarity with the programming language. Additionally, these generated codes may inadvertently utilize vulnerable built-in functions, potentially leading to source code vulnerabilities and exploits. This research undertakes an in-depth analysis and comparison of code generation, code completion, and security suggestions offered by prominent AI models, including OpenAI CodeX, CodeBert, and ChatGPT. The research aims to evaluate the effectiveness and security aspects of these tools in terms of their code generation, code completion capabilities, and their ability to enhance security. This analysis serves as a valuable resource for developers, enabling them to proactively avoid introducing security vulnerabilities in their projects. By doing so, developers can significantly reduce the need for extensive revisions and resource allocation, whether in the short or long term.

Engineering Approach to Assessing the Vulnerability of Water Abstraction

Variability in stream flow/discharge results in serious problems for engineers and difficulties in characterizing water systems under future climatic conditions. The management of water security in the engineering domain requires approaches aimed at minimizing the detrimental effects of the hydrological behavior of natural systems. Abstraction facilities must be strengthened to ensure sustainable supply and water security over time and at different scales. Several approaches and methodologies have been developed to translate water security into a framework that provides information on how to improve it. In this study, a scalar range idea is used to evaluate the sensitivity of a water resource system and cause–effect linkages define the vulnerability indicator as management-relevant information to address water security. This intuitively relates the extreme deviations of a particular streamflow to the average system response related to a particular hazard indicator. This determines the current stress in the operation of the abstraction facilities based on historical hydrometeorological changes, which is the basis for assessing future operational conditions and risks. This study uses streamflow extremes and averages as hazard-relevant indicators of water supply security. The results of the two case studies show that the applied approach fully appreciates the internal properties of water resource systems that affect the sensitivity/vulnerability of streamflow, as well as the derived streamflow vulnerability index and function. The obtained results were used to assess the vulnerability of water intake as well as the choice of safety factors and design parameters in accordance with the forecasted average annual and seasonal climate factors.

On Detecting and Measuring Exploitable JavaScript Functions in Real-world Applications

JavaScript is often rated as the most popular programming language for the development of both client-side and server-side applications. Because of its popularity, JavaScript has become a frequent target for attackers who exploit vulnerabilities in the source code to take control over the application. To address these JavaScript security issues, such vulnerabilities must be identified first. Existing studies in vulnerable code detection in JavaScript mostly consider package-level vulnerability tracking and measurements. However, such package-level analysis is largely imprecise, as real-world services that include a vulnerable package may not use the vulnerable functions in the package. Moreover, even the inclusion of a vulnerable function may not lead to a security problem if the function cannot be triggered with exploitable inputs. In this article, we develop a vulnerability detection framework that uses vulnerable pattern recognition and textual similarity methods to detect vulnerable functions in real-world JavaScript projects, combined with a static multi-file taint analysis mechanism to further assess the impact of the vulnerabilities on the whole project (i.e., whether the vulnerability can be exploited in a given project). We compose a comprehensive dataset of 1,360 verified vulnerable JavaScript functions using the Snyk vulnerability database and the VulnCode-DB project. From this ground-truth dataset, we build our vulnerable patterns for two common vulnerability types: prototype pollution and Regular Expression Denial of Service (ReDoS). With our framework, we analyze 9,205,654 functions (from 3,000 NPM packages, 1,892 websites and 557 Chrome Web extensions), and detect 117,601 prototype pollution and 7,333 ReDoS vulnerabilities. By further processing all 5,839 findings from NPM packages with our taint analyzer, we verify the exploitability of 290 zero-day cases across 134 NPM packages. In addition, we conduct an in-depth contextual analysis of the findings in 17 popular/critical projects and study the practical security exposure of 20 functions. With our semi-automated vulnerability reporting functionality, we disclosed all verified findings to project owners. We also obtained 25 published CVEs for our findings, 19 of them rated as “Critical” severity and six rated as “High” severity. Additionally, we obtained 169 CVEs that are currently “Reserved” (as of Apr. 2023). As evident from the results, our approach can shift JavaScript vulnerability detection from the coarse package/library level to the function level and thus improve the accuracy of detection and aid timely patching.