CASHEWS expands LLM package scanning to large bundled files

CASHEWS preprocesses large JavaScript packages with iterative deobfuscation, bundled-module and dynamic-code extraction, sink-aware backward slicing and abbreviation before LLM scanning. Across 512 files, two scanner types and three models, the authors report coverage rising to 98.8%-100%, false negatives falling by up to 18.6 points and net analysis cost falling 34.6%. Median preprocessing takes 30 seconds.

For supply-chain security teams, preprocessing may remove the context-window barrier that makes LLM scanners skip bundled packages. The cost result is promising because less irrelevant code reaches the model. No implementation is public, so this remains a reproduction target rather than a deployable control.