Small world with high risks: A study of security threats in the npm ecosystem
M Zimmermann, CA Staicu, C Tenny… - 28th USENIX Security …, 2019 - usenix.org
The popularity of JavaScript has lead to a large ecosystem of third-party packages available
via the npm software package registry. The open nature of npm has boosted its growth …
via the npm software package registry. The open nature of npm has boosted its growth …
On the impact of security vulnerabilities in the npm package dependency network
Security vulnerabilities are among the most pressing problems in open source software
package libraries. It may take a long time to discover and fix vulnerabilities in packages. In …
package libraries. It may take a long time to discover and fix vulnerabilities in packages. In …
Demystifying the vulnerability propagation and its evolution via dependency trees in the npm ecosystem
Third-party libraries with rich functionalities facilitate the fast development of JavaScript
software, leading to the explosive growth of the NPM ecosystem. However, it also brings …
software, leading to the explosive growth of the NPM ecosystem. However, it also brings …
Empirical analysis of security vulnerabilities in python packages
Software ecosystems play an important role in modern software development, providing an
open platform of reusable packages that speed up and facilitate development tasks …
open platform of reusable packages that speed up and facilitate development tasks …
An empirical comparison of dependency network evolution in seven software packaging ecosystems
Nearly every popular programming language comes with one or more package managers.
The software packages distributed by such package managers form large software …
The software packages distributed by such package managers form large software …
On the use of github actions in software development repositories
GitHub Actions was introduced in 2019 and constitutes an integrated alternative to CI/CD
services for GitHub repositories. The deep integration with GitHub allows repositories to …
services for GitHub repositories. The deep integration with GitHub allows repositories to …
An empirical study of usages, updates and risks of third-party libraries in java projects
Third-party libraries play a key role in software development as they can relieve developers
of the heavy burden of re-implementing common functionalities. However, third-party …
of the heavy burden of re-implementing common functionalities. However, third-party …
Structure and evolution of package dependency networks
Software developers often include available open-source software packages into their
projects to minimize redundant effort. However, adding a package to a project can also …
projects to minimize redundant effort. However, adding a package to a project can also …
Why do developers use trivial packages? an empirical case study on npm
Code reuse is traditionally seen as good practice. Recent trends have pushed the concept of
code reuse to an extreme, by using packages that implement simple and trivial tasks, which …
code reuse to an extreme, by using packages that implement simple and trivial tasks, which …
When and how to make breaking changes: Policies and practices in 18 open source software ecosystems
Open source software projects often rely on package management systems that help
projects discover, incorporate, and maintain dependencies on other packages, maintained …
projects discover, incorporate, and maintain dependencies on other packages, maintained …