Demystifying the vulnerability propagation and its evolution via dependency trees in the npm ecosystem

C Liu, S Chen, L Fan, B Chen, Y Liu… - Proceedings of the 44th …, 2022‏ - dl.acm.org
Third-party libraries with rich functionalities facilitate the fast development of JavaScript
software, leading to the explosive growth of the NPM ecosystem. However, it also brings …

On the discoverability of npm vulnerabilities in node. js projects

M Alfadel, DE Costa, E Shihab, B Adams - ACM Transactions on …, 2023‏ - dl.acm.org
The reliance on vulnerable dependencies is a major threat to software systems.
Dependency vulnerabilities are common and remain undisclosed for years. However, once …

Dependency-Induced Waste in Continuous Integration: An Empirical Study of Unused Dependencies in the npm Ecosystem

NR Weeraddana, M Alfadel, S McIntosh - Proceedings of the ACM on …, 2024‏ - dl.acm.org
Modern software systems are increasingly dependent upon code from external packages
(ie, dependencies). Building upon external packages allows software reuse to span across …

Investigating the resolution of vulnerable dependencies with dependabot security updates

H Mohayeji, A Agaronian… - 2023 IEEE/ACM 20th …, 2023‏ - ieeexplore.ieee.org
Modern software development practices increasingly rely on third-party libraries due to the
inherent benefits of reuse. However, libraries may contain security vulnerabilities that can …

Empirical analysis of security-related code reviews in npm packages

M Alfadel, NA Nagy, DE Costa, R Abdalkareem… - Journal of Systems and …, 2023‏ - Elsevier
Security issues are a major concern in software packages and their impact can be
detrimental if exploited. Modern code review is a widely-used practice that project …

VulNet: Towards improving vulnerability management in the Maven ecosystem

Z Ma, S Mondal, TH Chen, H Zhang… - Empirical Software …, 2024‏ - Springer
Developers rely on software ecosystems such as Maven to manage and reuse external
libraries (ie, dependencies). Due to the complexity of the used dependencies, developers …

The impact of new package managers on the library dependency ecosystem

K Rahkema, D Pfahl, R Ramler - PeerJ Computer Science, 2024‏ - peerj.com
Adding dependencies to third-party libraries through package managers is a common
practice in software development. The evolution of library dependency networks has been …

Vulnerability Propagation in Package Managers Used in iOS Development

K Rahkema, D Pfahl - 2023 IEEE/ACM 10th International …, 2023‏ - ieeexplore.ieee.org
Although using third-party libraries is common practice when writing software, vulnerabilities
may be found even in well-known libraries. Detected vulnerabilities are often fixed quickly in …

In Specs we Trust? Conformance-Analysis of Implementation to Specifications in Node-RED and Associated Security Risks

S Schneider, K Kashish, K Tuma… - arxiv preprint arxiv …, 2025‏ - arxiv.org
Low-code development frameworks for IoT platforms offer a simple drag-and-drop
mechanism to create applications for the billions of existing IoT devices without the need for …

[PDF][PDF] Dependency-Induced Waste in Continuous Integration

NR WEERADDANA, M ALFADEL, S MCINTOSH - 2024‏ - rebels.cs.uwaterloo.ca
The accrual of unused dependencies is also associated with detrimental effects on
Continuous Integration (CI) pipelines, ie, the automatic build and test routines that are …