Detecting JavaScript Libraries on the Web using Property-Order Graphs

Detecting front-end JavaScript libraries is essential for website profiling, vulnerability detection, and dependency management. However, bundlers transpile code in various ways, altering its original structure and complicating detection. State-of-the-art techniques detect libraries at runtime by matching property patterns exposed through the global object. They therefore miss libraries inaccessible from the global object, and identify versions only when version labels are exposed or property-level differences are large. More recent approaches inspect the bundled source, but either target a single bundler or require the target library as input. We present Debun, a scalable technique for detecting JavaScript libraries and their versions using function-level fingerprints. Our key insight is that bundlers preserve property names and the execution order of property operations. We introduce the property-order graph (POG), which captures this order within a function body, and make it robust to interprocedural transformations such as function inlining through preprocessing. To detect partially imported libraries caused by tree shaking, we propose a dependency-aware scoring function. Evaluations on 68 high-traffic websites with 78 libraries show that Debun outperforms five state-of-the-art tools, achieving a 94.64% F1-score in library detection and identifying 88 of the 98 ground-truth versions at the patch level.