Visual Graph Representations for Supply Chain Risk Detection: A Novel Study on npm Packages - Lima, Paulo Vitor C.; Quincozes, Silvio E.; Nascimento, Marcelo Z. do (Anais do Simpósio Brasileiro de Cibersegurança (SBSeg), 2026)
Identifying structural signals in software supply chain dependencies remains an open research challenge. We propose an exploratory approach: representing dependency graphs as adjacency-matrix images, making computer vision tools, texture analysis, Fourier transforms, spatial statistics, directly applicable. For 30 npm packages (15 with documented CVEs, 15 with no documented CVEs in the same period), we convert each dependency subgraph into a normalised 64× 64 image and extract 16 visual features (LBP, GLCM, Fourier, basic stats). In this exploratory sample, six visual features show nominal group separation (p < 0.05), while none of the nine classical graph metrics does. LBP features are the most discriminative, reaching a medium effect size (|d| = 0.740) under spectral node ordering.