Characterize the evolution and causes of recurring Node.js vulnerabilities

Determine how the observed trends in Node.js taint-style vulnerabilities evolve over time, particularly the rise in repeated vulnerability classes within packages and the possible role of AI-assisted vulnerability discovery and software development.

Background

The benchmark provides an initial longitudinal analysis of Node.js taint-style vulnerabilities, including the frequency with which a package experiences the same vulnerability class again after an earlier issue has been patched. The authors observe a substantial increase in such recurrences in 2026 and discuss AI-assisted discovery and development as possible explanations, but the available data do not establish causality. They identify continued tracking of these trends as an unresolved direction.