Characterizing Dependency Update Practice of NPM, PyPI and Cargo Packages

arXiv:2403.17382v1 Announce Type: cross
Abstract: Keeping dependencies up-to-date prevents software supply chain attacks through outdated and vulnerable dependencies. Developers may use packages' dependency update practice as one of the selection criteria for choosing a package as a dependency. However, the lack of metrics characterizing packages' dependency update practice makes this assessment difficult. To measure the up-to-date characteristics of packages, we focus on the dependency management aspect and propose two update metrics: Time-Out-Of-Date (TOOD) and Post-Fix-Exposure-Time (PFET), to measure the updatedness …

arxiv attacks cargo cs.cr cs.se date dependencies dependency developers may metrics npm package packages practice pypi software software supply chain software supply chain attacks supply supply chain supply chain attacks update up-to-date vulnerable