JScamd: An Automated Static Taint Analysis Framework for Detecting Cryptographic API Misuses in JavaScript

Cryptographic APIs are essential to application security, yet frequent developer misuse leads to widespread vulnerabilities. Detecting cryptographic misuse in JavaScript is challenging due to its dynamic semantics and fragmented cryptographic library ecosystem, which hinder static analysis tools from accurately modeling data flows and covering non-standard or evolving libraries, leading to high false-negative rates.

In this paper, we propose JScamd, a static analysis framework for scalable detection of cryptographic misuse in JavaScript. JScamd integrates an enhanced program representation engine, an LLM-assisted taint rule generation pipeline, and a precise static taint analysis engine to address JavaScript dynamic features. Building upon 16 systematically defined cryptographic security constraints, JScamd automatically analyzes cryptographic APIs, identifies security-sensitive taint sources and sinks, and synthesizes comprehensive taint analysis rules. This design enables accurate detection of cryptographic misuse across diverse JavaScript libraries and application scenarios. We performed a comprehensive large-scale evaluation on 322 widely adopted JavaScript projects. JScamd detects 1,059 misuses and achieves 97.78% precision, significantly outperforming three state-of-the-art tools. Our analysis further uncovers previously unknown vulnerabilities, resulting in 41 assigned CVEs. These results demonstrate that JScamd effectively bridges cryptographic security specifications and ecosystem-scale vulnerability detection in JavaScript.