Abstract:Vulnerabilities are known reported security threats that affect a large amount of packages in the npm ecosystem. To mitigate these security threats, the open-source community strongly suggests vulnerable packages to timely publish vulnerability fixes and recommends affected packages to update their dependencies. However, there are still serious lags in the propagation of vulnerability fixes in the ecosystem. In our preliminary study on the latest versions of 356,283 active npm packages, we found that 20.0% of them can still introduce vulnerabilities via direct or transitive dependencies although the involved vulnerable packages have already published fix versions for over a year. Prior study by (Chinthanet et al. 2021) lays the groundwork for research on how to mitigate propagation lags of vulnerability fixes in an ecosystem. They conducted an empirical investigation to identify lags that might occur between the vulnerable package release and its fixing release. They found that factors such as the branch upon which a fix landed and the severity of the vulnerability had a small effect on its propagation trajectory throughout the ecosystem. To ensure quick adoption and propagation of a release that contains the fix, they gave several actionable advice to developers and researchers. However, it is still an open question how to design an effective technique to accelerate the propagation of vulnerability fixes. Motivated by this problem, in this paper, we conducted an empirical study to learn the scale of packages that block the propagation of vulnerability fixes in the ecosystem and investigate their evolution characteristics. Furthermore, we distilled the remediation strategies that have better effects on mitigating the fix propagation lags. Leveraging our empirical findings, we propose an ecosystem-level technique, Plumber, for deriving feasible remediation strategies to boost the propagation of vulnerability fixes. To precisely diagnose the causes of fix propagation blocking, Plumber models the vulnerability metadata, and npm dependency metadata and continuously monitors their evolution. By analyzing a full-picture of the ecosystem-level dependency graph and the corresponding fix propagation statuses, it derives remediation schemes for pivotal packages. In the schemes, Plumber provides customized remediation suggestions with vulnerability impact analysis to arouse package developers’ awareness. We applied Plumber to generating 268 remediation reports for the identified pivotal packages, to evaluate its remediation effectiveness based on developers’ feedback. Encouragingly, 47.4% our remediation reports received positive feedback from many well-known npm projects, such as Tensorflow/tfjs, Ethers.js, and GoogleChrome/workbox. Our reports have boosted the propagation of vulnerability fixes into 16,403 root packages through 92,469 dependency paths. On average, each remediated package version is receiving 72,678 downloads per week by the time of this work.

Containing Malicious Package Updates in npm with a Lightweight Permission System

HODOR: Shrinking Attack Surface on Node.js Via System Call Limitation

You Can Run But You Can't Hide: Runtime Protection Against Malicious Package Updates For Node.js

On the Threat of npm Vulnerable Dependencies in Node.js Applications

Practical Automated Detection of Malicious npm Packages

What are Weak Links in the npm Supply Chain?

A Survey on Common Threats in npm and PyPi Registries

On the Impact of Micro-Packages: An Empirical Study of the npm JavaScript Ecosystem

Mir: Automated Quantifiable Privilege Reduction Against Dynamic Library Compromise in JavaScript

DONAPI: Malicious NPM Packages Detector using Behavior Sequence Knowledge Mapping

Abusing Hidden Properties to Attack the Node.js Ecosystem

Flexible and Optimal Dependency Management via Max-SMT

SpiderScan: Practical Detection of Malicious NPM Packages Based on Graph-Based Behavior Modeling and Matching

Silent Spring: Prototype Pollution Leads to Remote Code Execution in Node.js

Dependency Practices for Vulnerability Mitigation

A Large Scale Analysis of Semantic Versioning in NPM

Demystifying the Vulnerability Propagation and Its Evolution Via Dependency Trees in the NPM Ecosystem

On the Feasibility of Cross-Language Detection of Malicious Packages in npm and PyPI

Plumber: Boosting the Propagation of Vulnerability Fixes in the npm Ecosystem

Mayall: A Framework for Desktop JavaScript Auditing and Post-Exploitation Analysis

Unveiling the Invisible: Detection and Evaluation of Prototype Pollution Gadgets with Dynamic Taint Analysis