Collected research

You Are What You Include: Large-scale Evaluation of Remote JavaScript Inclusions

Nick Nikiforakis, Luca Invernizzi, Alexandros Kapravelos, Steven Van Acker, Wouter Joosen, Christopher Kruegel, Frank Piessens and Giovanni Vigna · securitee.org

A crawl of 3.3 million pages across the Alexa top 10,000 found 8.4 million remote script inclusions drawn from 20,225 hosts, and a quality-of-maintenance metric scored each provider. Four new fault classes appeared: localhost and private-IP inclusions, stale domain and stale IP inclusions, and typosquatted script URLs (TXSS). Registering googlesyndicatio.com drew 163,188 visitors in 15 days.

Record

Researcher

Nick Nikiforakis, Luca Invernizzi, Alexandros Kapravelos, Steven Van Acker, Wouter Joosen, Christopher Kruegel, Frank Piessens and Giovanni Vigna

Published by

securitee.org

Format

Whitepaper

Topic

Server

In the archive

• Collected in the 2012 research round

Tags

• large-scale-scan
• measurement-study
• javascript
• supply-chain
• typosquatting
• mitigation
• xss
• owasp-a03-2021
• owasp-a06-2021

This page is the archive's own catalogue record. The research is the work of Nick Nikiforakis, Luca Invernizzi, Alexandros Kapravelos, Steven Van Acker, Wouter Joosen, Christopher Kruegel, Frank Piessens and Giovanni Vigna, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.