Abstract:Vulnerabilities are known reported security threats that affect a large amount of packages in the npm ecosystem. To mitigate these security threats, the open-source community strongly suggests vulnerable packages to timely publish vulnerability fixes and recommends affected packages to update their dependencies. However, there are still serious lags in the propagation of vulnerability fixes in the ecosystem. In our preliminary study on the latest versions of 356,283 active npm packages, we found that 20.0% of them can still introduce vulnerabilities via direct or transitive dependencies although the involved vulnerable packages have already published fix versions for over a year. Prior study by (Chinthanet et al. 2021) lays the groundwork for research on how to mitigate propagation lags of vulnerability fixes in an ecosystem. They conducted an empirical investigation to identify lags that might occur between the vulnerable package release and its fixing release. They found that factors such as the branch upon which a fix landed and the severity of the vulnerability had a small effect on its propagation trajectory throughout the ecosystem. To ensure quick adoption and propagation of a release that contains the fix, they gave several actionable advice to developers and researchers. However, it is still an open question how to design an effective technique to accelerate the propagation of vulnerability fixes. Motivated by this problem, in this paper, we conducted an empirical study to learn the scale of packages that block the propagation of vulnerability fixes in the ecosystem and investigate their evolution characteristics. Furthermore, we distilled the remediation strategies that have better effects on mitigating the fix propagation lags. Leveraging our empirical findings, we propose an ecosystem-level technique, Plumber, for deriving feasible remediation strategies to boost the propagation of vulnerability fixes. To precisely diagnose the causes of fix propagation blocking, Plumber models the vulnerability metadata, and npm dependency metadata and continuously monitors their evolution. By analyzing a full-picture of the ecosystem-level dependency graph and the corresponding fix propagation statuses, it derives remediation schemes for pivotal packages. In the schemes, Plumber provides customized remediation suggestions with vulnerability impact analysis to arouse package developers’ awareness. We applied Plumber to generating 268 remediation reports for the identified pivotal packages, to evaluate its remediation effectiveness based on developers’ feedback. Encouragingly, 47.4% our remediation reports received positive feedback from many well-known npm projects, such as Tensorflow/tfjs, Ethers.js, and GoogleChrome/workbox. Our reports have boosted the propagation of vulnerability fixes into 16,403 root packages through 92,469 dependency paths. On average, each remediated package version is receiving 72,678 downloads per week by the time of this work.

How Do Developers Follow Security-Relevant Best Practices When Using NPM Packages?

On the Threat of npm Vulnerable Dependencies in Node.js Applications

Dependency Practices for Vulnerability Mitigation

What are Weak Links in the npm Supply Chain?

On the impact of security vulnerabilities in the npm and RubyGems dependency networks

A Survey on Common Threats in npm and PyPi Registries

Do Software Security Practices Yield Fewer Vulnerabilities?

Unveil the Mystery of Critical Software Vulnerabilities

Containing Malicious Package Updates in npm with a Lightweight Permission System

Demystifying the Vulnerability Propagation and Its Evolution Via Dependency Trees in the NPM Ecosystem

Node package manager's dependency network robustness

A Large Scale Analysis of Semantic Versioning in NPM

Plumber: Boosting the Propagation of Vulnerability Fixes in the npm Ecosystem

A Large-Scale Empirical Study of Open Source License Usage: Practices and Challenges

On the Impact of Micro-Packages: An Empirical Study of the npm JavaScript Ecosystem

What makes a good Node.js package? Investigating Users, Contributors, and Runnability

An empirical study of bloated dependencies in CommonJS packages

Opportunities and Security Risks of Technical Leverage: A Replication Study on the NPM Ecosystem

Lags in the release, adoption, and propagation of npm vulnerability fixes

Abusing Hidden Properties to Attack the Node.js Ecosystem

What are the characteristics of highly-selected packages? A case study on the npm ecosystem