DEBUN-Data

Artifact for DEBUN: Detecting Bundled JavaScript Libraries on the Web using Property-Order Graphs This record holds the datasets the DEBUN artifact downloads. The code, the ground truth, and every table and figure generator live in the Git repository; published here is only what cannot be committed. Each archive is fetched by one script at the repository root, which unpacks it into the path the tools expect. debun-databases.tar.gz (114 MB)The fingerprint databases DEBUN scores against: the POG fingerprint cache built from the CDN corpus and the npm import graph, the website fingerprints for the 68 evaluated sites, the flat hash database behind the detect CLI, and the ψ=84% detection summaries. Start here — this one archive is enough to reproduce the paper's detection results. ablation-caches.tar.gz (148 MB)One fingerprint cache per reduced POG model (cnt, cfg, f, fb, fbc) with its detection summary, for the detection-across-POG-models ablation. baseline-inputs.tar.gz (526 MB) Inputs for the two static baselines: the fine-tuned D-Bundlr checkpoint and its label map, the 227 prebuilt Aletheia package indices, the 192-bundle evaluation dataset, and D-Bundlr's training corpora. The baselines' own source is not redistributed here; ./baseline-repos.sh clones both upstream repositories at pinned commits. rq3-bundles.tar.gz (64 MB)The controlled bundle corpus in three variants — unminified, swc-minified, terser-minified — used to measure POG robustness under minification. website-crawled-code.tar.gz (288 MB)Every JavaScript file crawled from the ground-truth websites, so the website fingerprints can be rebuilt from source rather than taken on trust. Not in this record. ground-truth-evidence.tar.gz — the per-site notes recording how each library instance in the ground truth was confirmed — is unchanged since the earlier record and stays there (https://zenodo.org/records/16992345). The download script fetches that one file from it, so it is not duplicated here.