Lags in the release, adoption, and propagation of npm vulnerability fixes
Authors – Bodin Chinthanet, Raula Gaikovina Kula (NAIST), Shane McIntosh (Waterloo University), Takashi Ishio (NAIST), Akinori Ihara, Kenichi Matsumoto
Venue – Transactions on Software Engineering
Abstract – Security vulnerability in third-party dependencies is a growing concern not only for developers of the affected software, but for the risks it poses to an entire software ecosystem, e.g., Heartbleed vulnerability. Recent studies show that developers are slow to respond to the threat of vulnerability, sometimes taking four to eleven months to act. To ensure quick adoption and propagation of a release that contains the fix (fixing release), we conduct an empirical investigation to identify lags that may occur between the vulnerable release and its fixing release (package-side fixing release). Through a preliminary study of 231 package-side fixing release of npm projects on GitHub, we observe that a fixing release is rarely released on its own, with up to 85.72% of the bundled commits being unrelated to a fix. We then compare the package-side fixing release with changes on a client-side (client-side fixing release). Through an empirical study of the adoption and propagation tendencies of 1,290 package-side fixing releases that impact throughout a network of 1,553,325 releases of npm packages, we find that stale clients require additional migration effort, even if the package-side fixing release was quick (i.e., package-side fixing releasetypeSpatch). Furthermore, we show the influence of factors such as the branch that the package-side fixing release lands on and the severity of vulnerability on its propagation. In addition to these lags we identify and characterize, this paper lays the groundwork for future research on how to mitigate propagation lags in an ecosystem.
Preprint – [PDF]
奈良先端大，ウォータールー大学（カナダ）との共著論文がソフトウェア工学分野最高峰の学術論文誌Empirical Software Engineering (EMSE) に採録されました．
関連記事
[Web] Empirical Software Engineering
BibTeX
@article{Bodin-emse-202103,
author = {Bodin Chinthanet, Raula Gaikovina Kula, Shane McIntosh, Takashi Ishio, Akinori Ihara & Kenichi Matsumoto },
title = {Lags in the release, adoption, and propagation of npm vulnerability fixes},
journal = {Empirical Software Engineering},
volume = 26,
number = 47,
pages = {1-28},
year = 2021,
month = {Mar},
}
author = {Bodin Chinthanet, Raula Gaikovina Kula, Shane McIntosh, Takashi Ishio, Akinori Ihara & Kenichi Matsumoto },
title = {Lags in the release, adoption, and propagation of npm vulnerability fixes},
journal = {Empirical Software Engineering},
volume = 26,
number = 47,
pages = {1-28},
year = 2021,
month = {Mar},
}
