Imagine you're a city health inspector, but the restaurant database you rely on was last updated in 2022. New restaurants open daily, old ones change hands, and the inspection criteria evolve — but your list is frozen. Every study you publish about food safety is based on a snapshot that gets staler by the month. That's the state of Node.js vulnerability research: the benchmarks everyone uses stopped recording new vulnerabilities years ago, and the packages they reference keep getting yanked from npm, making old exploits unreproducible. X.js is a live benchmark — not a static dataset — of real-world Node.js taint-style vulnerabilities. Taint-style means data flows from an attacker-controlled source (user input, environment variables, HTTP headers) through the program to a dangerous sink (eval(), exec(), file-system write). The benchmark covers four vulnerability classes: code injection, command injection, prototype pollution, and path traversal. Built from 1,738 advisories scraped primarily from the GitHub Advisory Database through mid-2026, X.js pairs each vulnerability with precise source-sink annotations, a validated executable exploit, and the exploit's execution trace. The engineering contribution matters as much as the data. Every vulnerable package version is mirrored in a self-hosted npm registry, so when maintainers yank packages — or npm itself removes them — the benchmark doesn't silently rot. Dedicated infrastructure generates and validates exploits for newly reported vulnerabilities, making this a living organism rather than a one-time dump. The current release ships 1,159 validated exploits across 965 distinct packages, covering advisories from approximately 2017 through mid-2026. The longitudinal analysis reveals a structural shift in the ecosystem. Vulnerable packages are getting dramatically larger: the median vulnerable package grew from roughly 250 lines of code in 2021-2022 to 6,100 LoC in 2026 — a ~24× increase. This is not a quirk of sampling; it reflects the migration of taint-style vulnerabilities from small utility libraries into larger, more complex application-level packages. For tool builders, this means static and dynamic analysis techniques calibrated on small packages may fail on the vulnerability surface of 2025-2026. The strongest prior benchmarks in this space — SecBench.js, Nodest's curated set, and various subsets of the Snyk database — all freeze at or before 2022 and suffer from npm package removal degrading reproducibility over time. X.js doesn't just update the data; it solves the infrastructure problem that made previous benchmarks decay. The self-hosted registry and automated exploit validation pipeline are the real architectural advances here. Integrity-wise, every exploit is executed and validated against the actual vulnerable package version, which is a higher bar than most vulnerability datasets clear (many rely on advisory descriptions without confirmed exploitation). The limitation is that this is still author-validated, not independently replicated, and the exploit generation pipeline's false-negative rate — vulnerabilities it can't automatically exploit — is not exhaustively characterized. The paper focuses on taint-style vulns, so prototype pollution gadget chains and more exotic attack patterns are only partially covered. The practical upshot: if you build or evaluate any Node.js security tool — static analyzers, taint trackers, exploit generators, automated patchers — X.js is now the benchmark to beat. It's large enough, current enough, and reproducible enough to be the standard evaluation target. The live-update infrastructure is what separates it from being yet another CSV of CVEs.
