Small world with high risks: A study of security threats in the npm ecosystem
M Zimmermann, CA Staicu, C Tenny… - 28th USENIX Security …, 2019 - usenix.org
The popularity of JavaScript has lead to a large ecosystem of third-party packages available
via the npm software package registry. The open nature of npm has boosted its growth …
via the npm software package registry. The open nature of npm has boosted its growth …
Demystifying the vulnerability propagation and its evolution via dependency trees in the npm ecosystem
Third-party libraries with rich functionalities facilitate the fast development of JavaScript
software, leading to the explosive growth of the NPM ecosystem. However, it also brings …
software, leading to the explosive growth of the NPM ecosystem. However, it also brings …
Empirical analysis of security vulnerabilities in python packages
Software ecosystems play an important role in modern software development, providing an
open platform of reusable packages that speed up and facilitate development tasks …
open platform of reusable packages that speed up and facilitate development tasks …
On the use of github actions in software development repositories
GitHub Actions was introduced in 2019 and constitutes an integrated alternative to CI/CD
services for GitHub repositories. The deep integration with GitHub allows repositories to …
services for GitHub repositories. The deep integration with GitHub allows repositories to …
How to characterize the health of an Open Source Software project? A snowball literature review of an emerging practice
Motivation: Society's dependence on Open Source Software (OSS) and the communities that
maintain the OSS is ever-growing. So are the potential risks of, eg, vulnerabilities being …
maintain the OSS is ever-growing. So are the potential risks of, eg, vulnerabilities being …
An empirical study of usages, updates and risks of third-party libraries in java projects
Third-party libraries play a key role in software development as they can relieve developers
of the heavy burden of re-implementing common functionalities. However, third-party …
of the heavy burden of re-implementing common functionalities. However, third-party …
Modular call graph construction for security scanning of node. js applications
Most of the code in typical Node. js applications comes from third-party libraries that consist
of a large number of interdependent modules. Because of the dynamic features of …
of a large number of interdependent modules. Because of the dynamic features of …
On the impact of security vulnerabilities in the npm and RubyGems dependency networks
The increasing interest in open source software has led to the emergence of large language-
specific package distributions of reusable software libraries, such as npm and RubyGems …
specific package distributions of reusable software libraries, such as npm and RubyGems …
On the outdatedness of workflows in the GitHub Actions ecosystem
GitHub Actions was introduced as a way to automate CI/CD workflows in GitHub, the largest
social coding platform. Thanks to its deep integration into GitHub, GitHub Actions can be …
social coding platform. Thanks to its deep integration into GitHub, GitHub Actions can be …
What do package dependencies tell us about semantic versioning?
The semantic versioning (semver) policy is commonly accepted by open source package
management systems to inform whether new releases of software packages introduce …
management systems to inform whether new releases of software packages introduce …