Abstract:Third-party libraries with rich functionalities facilitate the fast development of JavaScript software, leading to the explosive growth of the NPM ecosystem. However, it also brings new security threats that vulnerabilities could be introduced through dependencies from third-party libraries. In particular, the threats could be excessively amplified by transitive dependencies. Existing research only considers direct dependencies or reasoning transitive dependencies based on reachability analysis, which neglects the NPM-specific dependency resolution rules as adapted during real installation, resulting in wrongly resolved dependencies. Consequently, further fine-grained analysis, such as precise vulnerability propagation and their evolution over time in dependencies, cannot be carried out precisely at a large scale, as well as deriving ecosystem-wide solutions for vulnerabilities in dependencies. To fill this gap, we propose a knowledge graph-based dependency resolution, which resolves the inner dependency relations of dependencies as trees (i.e., dependency trees), and investigates the security threats from vulnerabilities in dependency trees at a large scale. Specifically, we first construct a complete dependency-vulnerability knowledge graph (DVGraph) that captures the whole NPM ecosystem (over 10 million library versions and 60 million well-resolved dependency relations). Based on it, we propose a novel algorithm (DTResolver) to statically and precisely resolve dependency trees, as well as transitive vulnerability propagation paths, for each package by taking the official dependency resolution rules into account. Based on that, we carry out an ecosystem-wide empirical study on vulnerability propagation and its evolution in dependency trees. Our study unveils lots of useful findings, and we further discuss the lessons learned and solutions for different stakeholders to mitigate the vulnerability impact in NPM based on our findings. For example, we implement a dependency tree based vulnerability remediation method (DTReme) for NPM packages, and receive much better performance than the official tool (npm audit fix).

A Preliminary Study on Self-Contained Libraries in the NPM Ecosystem

An empirical study of bloated dependencies in CommonJS packages

On the Impact of Micro-Packages: An Empirical Study of the npm JavaScript Ecosystem

Self-Admitted Library Migrations in Java, JavaScript, and Python Packaging Ecosystems: A Comparative Study

Contributing Back to the Ecosystem: A User Survey of NPM Developers

Giving Back: Contributions Congruent to Library Dependency Changes in a Software Ecosystem

Dependency Smells in JavaScript Projects

Opportunities and Security Risks of Technical Leverage: A Replication Study on the NPM Ecosystem

How Do Developers Follow Security-Relevant Best Practices When Using NPM Packages?

A Comprehensive Study of Bloated Dependencies in the Maven Ecosystem

A Large Scale Analysis of Semantic Versioning in NPM

Analysis of Library Dependency Networks of Package Managers Used in iOS Development

Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web

Towards Understanding Third-party Library Dependency in C/C++ Ecosystem

Understanding the role of external pull requests in the NPM ecosystem

Less is More? An Empirical Study on Configuration Issues in Python PyPI Ecosystem

An Exploration of npm Package Co-Usage Examples from Stack Overflow: A Case Study

Node package manager's dependency network robustness

A Longitudinal Analysis of Bloated Java Dependencies

Efficiently Trimming the Fat: Streamlining Software Dependencies with Java Reflection and Dependency Analysis

Demystifying the Vulnerability Propagation and Its Evolution Via Dependency Trees in the NPM Ecosystem