Security Signature Inference for JavaScript-based Browser Addons