Abstract:Today’s software industry heavily relies on open source software (OSS). However, the rapidly increasing number of OSS software vulnerabilities (SVs) poses huge security risks to the software supply chain. Managing the SVs in the relied OSS components has become a critical concern for software vendors. Due to the limited resources in practice, an essential focus for the vendors is to locate and prioritize the remediation of critical SVs (CSVs), i.e., those tend to cause huge losses. Particularly, in the software industry, vendors are obliged to comply with the security service level agreement (SLA), which mandates the fix of CSVs within a short time frame (e.g., 15 days). However, to the best of our knowledge, there is no empirical study that specifically investigates CSVs. The existing works only target at general SVs, missing a view of the unique characteristics of CSVs. In this paper, we investigate the distributions (from temporal, type, and repository dimension) and the current remediation practice of CSVs in the OSS ecosystem, especially their differences compared with non-critical SVs (NCSVs). We adopt the industry standard to refer SVs with a 9+ Common Vulnerability Scoring System (CVSS) score as CSVs and others as NCSVs. We collect a large-scale dataset containing 14,867 SVs and artifacts associated with their remediation (e.g., issue report, commit) across 4,462 GitHub repositories. Our findings regarding CSV distributions can help practitioners better locate these hot spots. Regarding the remediation practice, we observe that though CSVs receive higher priorities, some practices (e.g., complicated review and testing pro-cess) may unintentionally cause the delay to their fixes. We also point out the risks of SV information leakage during remediation process, which could leave a window-of-opportunity of over 30 days on median for zero-day attacks. Based on our findings, we provide implications to improve the current CSV remediation practice.

A Large-scale Fine-grained Analysis of Packages in Open-Source Software Ecosystems

A Large-Scale Empirical Study of Open Source License Usage: Practices and Challenges

OSS Malicious Package Analysis in the Wild

SpiderScan: Practical Detection of Malicious NPM Packages Based on Graph-Based Behavior Modeling and Matching

PackageIntel: Leveraging Large Language Models for Automated Intelligence Extraction in Package Ecosystems

An Empirical Study of Malicious Code In PyPI Ecosystem

Unveil the Mystery of Critical Software Vulnerabilities

A Machine Learning-Based Approach For Detecting Malicious PyPI Packages

Malicious Packages Lurking in User-Friendly Python Package Index.

DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping

On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI

Malicious Package Detection using Metadata Information

Towards Robust Detection of Open Source Software Supply Chain Poisoning Attacks in Industry Environments

Leveraging Large Language Models to Detect npm Malicious Packages

Investigating Package Related Security Threats in Software Registries

MalWuKong: Towards Fast, Accurate, and Multilingual Detection of Malicious Code Poisoning in OSS Supply Chains

Killing Two Birds with One Stone: Malicious Package Detection in NPM and PyPI Using a Single Model of Malicious Behavior Sequence

Towards Using Source Code Repositories to Identify Software Supply Chain Attacks

Anomalicious: Automated Detection of Anomalous and Potentially Malicious Commits on GitHub

Practical Automated Detection of Malicious npm Packages

A Survey on Common Threats in npm and PyPi Registries