PatchPorter: LLM-Driven Security Patch Porting via Version Tracing and Context Selection for NPM

Abstract

Third-Party Libraries are widely used in modern software development, yet their vulnerabilities pose serious security risks. This issue is particularly severe in the NPM ecosystem, where high-risk 1-day vulnerabilities can remain unpatched for extended periods. Although upgrading to the latest patched version is commonly recommended, it often causes major compatibility issues. Patch porting offers an effective solution to this challenge. However, existing patch porting methods are mainly designed for C and have two limitations when applied to NPM. First, they can be brittle in precisely localizing fix locations when substantial semantic gaps exist across versions. Second, they rely on either excessive or insufficient context for patch adaptation, which may introduce redundant information and increase the risk of hallucination. This paper introduces PatchPorter, a method for single-branch security patch porting in NPM that builds on Large Language Models (LLMs). PatchPorter addresses these limitations through two modules. The localization module leverages LLM semantic understanding and code evolution analysis over version histories maintained by version control systems to identify fix locations. The context selection module analyzes patch dependencies to select minimal yet sufficient context around the localized fix location. The selected context is used as input for the LLM to generate the patch. We construct a dataset of 112 NPM vulnerabilities with Proof- of-Concepts for dynamic validation. Experimental results show that PatchPorter significantly surpasses other methods in accuracy, achieving a 26.23% improvement over the best-performing baseline and a 70.59% increase on the most difficult tasks. Its ability to handle various vulnerability types highlights its practical value. Additional results confirm that both of its main modules also outperform alternative approaches.