CASHEWS preprocesses large JavaScript packages with iterative deobfuscation, bundled-module and dynamic-code extraction, sink-aware backward slicing and abbreviation before LLM scanning. Across 512 files, two scanner types and three models, the authors report coverage rising to 98.8%-100%, false negatives falling by up to 18.6 points and net analysis cost falling 34.6%. Median preprocessing takes 30 seconds.
CASHEWS expands LLM package scanning to large bundled files
2026-09-17Frontier watchWATCH
CASHEWS preprocesses large JavaScript packages with iterative deobfuscation, bundled-module and dynamic-code extraction, sink-aware backward slicing and abbreviation before LLM scanning. Across 512 files, two scanner types and three models, the authors report coverage rising to 98.8%-100%, false negatives falling by up to 18.6 points and net analysis cost falling 34.6%. Median preprocessing takes 30 seconds.
Imported from the existing research archive. Migration preserves the recorded judgment and is not a fresh verification.
What this means for you
For supply-chain security teams, preprocessing may remove the context-window barrier that makes LLM scanners skip bundled packages. The cost result is promising because less irrelevant code reaches the model. No implementation is public, so this remains a reproduction target rather than a deployable control.
FRONTIER WATCH
Public artifacts and validated results are different.
The recorded fact is the public work and its artifacts. Author-reported outcomes do not establish independent reproduction. Next checks include usable code, task conditions and third-party validation.
Evidence & related material
Technical details & scores
| Dataset | 512 large package files |
|---|---|
| Coverage | 98.8%-100% |
| False Negative Change | up to -18.6 points |
| Net Cost Change | -34.6% |
| Median Preprocessing | 30 seconds |
Technical impact 3
Engineering value 4
Adoption signal 1
Maturity 1
Verification cost 4
Risk 3