X.js: A Live Benchmark for Node.js Taint-Style Vulnerabilities
A constantly updated catalog of real JavaScript security flaws for testing defenses
Researchers created X.js, a live benchmark of 1,159 real vulnerabilities in Node.js packages collected through mid-2026, each paired with working exploits and patched versions. The dataset reveals that vulnerable packages have grown dramatically larger over time—from around 250 lines of code in 2021–2022 to 6,100 lines by 2026—making security problems harder to spot and fix.
Security researchers and tool developers need current, real-world vulnerabilities to test whether their detection and defense systems actually work. Previous datasets stopped in 2022, leaving a four-year gap; X.js stays current and includes automated infrastructure to add newly discovered flaws. Larger, more complex vulnerable packages mean attackers have more hiding places and defenders need better tools—having a constantly refreshed test suite lets the security community measure whether their solutions keep up.