{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,11,1]],"date-time":"2026-11-01T02:15:50Z","timestamp":1793499350091,"version":"4.5.0"},"reference-count":57,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2021,3,30]],"date-time":"2021-03-30T00:00:00Z","timestamp":1617062400000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2021,3,30]],"date-time":"2021-03-30T00:00:00Z","timestamp":1617062400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Empir Software Eng"],"published-print":{"date-parts":[[2021,5]]},"abstract":"<jats:title>Abstract<\/jats:title><jats:p>Security vulnerability in third-party dependencies is a growing concern not only for developers of the affected software, but for the risks it poses to an entire software ecosystem, e.g., Heartbleed vulnerability. Recent studies show that developers are slow to respond to the threat of vulnerability, sometimes taking four to eleven months to act. To ensure quick adoption and propagation of a release that contains the fix (<jats:italic>fixing release<\/jats:italic>), we conduct an empirical investigation to identify lags that may occur between the vulnerable release and its fixing release (<jats:italic>package-side fixing release<\/jats:italic>). Through a preliminary study of 231 package-side fixing release of npm projects on GitHub, we observe that a fixing release is rarely released on its own, with up to 85.72% of the bundled commits being unrelated to a fix. We then compare the package-side fixing release with changes on a client-side (<jats:italic>client-side fixing release<\/jats:italic>). Through an empirical study of the adoption and propagation tendencies of 1,290 package-side fixing releases that impact throughout a network of 1,553,325 releases of npm packages, we find that stale clients require additional migration effort, even if the package-side fixing release was quick (i.e., package-side fixing releasetypeSpatch). Furthermore, we show the influence of factors such as the branch that the package-side fixing release lands on and the severity of vulnerability on its propagation. In addition to these lags we identify and characterize, this paper lays the groundwork for future research on how to mitigate propagation lags in an ecosystem.<\/jats:p>","DOI":"10.1007\/s10664-021-09951-x","type":"journal-article","created":{"date-parts":[[2021,3,30]],"date-time":"2021-03-30T16:03:27Z","timestamp":1617120207000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":64,"title":["Lags in the release, adoption, and propagation of npm vulnerability fixes"],"prefix":"10.1007","volume":"26","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4439-1608","authenticated-orcid":false,"given":"Bodin","family":"Chinthanet","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Raula Gaikovina","family":"Kula","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Shane","family":"McIntosh","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Takashi","family":"Ishio","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Akinori","family":"Ihara","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Kenichi","family":"Matsumoto","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2021,3,30]]},"reference":[{"key":"9951_CR1","doi-asserted-by":"crossref","unstructured":"Abdalkareem R, Nourry O, Wehaibi S, Mujahid S, Shihab E (2017) Why Do Developers Use Trivial Packages? An Empirical Case Study on npm. In: Proceedings of the 11th Joint Meeting on Foundations of Software Engineering (ESEC\/FSE), pp 385\u2013395","DOI":"10.1145\/3106237.3106267"},{"issue":"3","key":"9951_CR2","doi-asserted-by":"publisher","first-page":"219","DOI":"10.1016\/j.cose.2006.10.002","volume":"26","author":"OH Alhazmi","year":"2007","unstructured":"Alhazmi O H, Malaiya Y K, Ray I (2007) Measuring, analyzing and predicting security vulnerabilities in software systems. Comput Secur 26(3):219\u2013228","journal-title":"Comput Secur"},{"key":"9951_CR3","doi-asserted-by":"crossref","unstructured":"Bavota G, Canfora G, Di Penta M, Oliveto R, Panichella S (October 2015) How the Apache Community Upgrades Dependencies: An Evolutionary Study. Empir Softw Eng (EMSE) 20(5):1275\u20131317","DOI":"10.1007\/s10664-014-9325-9"},{"key":"9951_CR4","unstructured":"Bennett J T (2014) Shellshock in the Wild - Shellshock in the Wild. https:\/\/www.fireeye.com\/blog\/threat-research\/2014\/09\/shellshock-in-the-wild.htmlhttps:\/\/www.fireeye.com\/blog\/threat-research\/2014\/09\/shellshock-in-the-wild.html. (Accessed on 02\/08\/2021)"},{"key":"9951_CR5","doi-asserted-by":"crossref","unstructured":"Bogart C, K\u00e4stner C, Herbsleb J, Thung F (2016) How to Break an API: Cost Negotiation and Community Values in Three Software Ecosystems. In: Proceedings of the 24th International Symposium on the Foundations of Software Engineering (FSE), pp 109\u2013120","DOI":"10.1145\/2950290.2950325"},{"key":"9951_CR6","doi-asserted-by":"crossref","unstructured":"Cadariu M, Bouwers E, Visser J, van Deursen A (2015) Tracking known security vulnerabilities in proprietary software systems. In: Proceedings of the 22nd International Conference on Software Analysis, Evolution, and Reengineering (SANER), pp 516\u2013519","DOI":"10.1109\/SANER.2015.7081868"},{"issue":"3","key":"9951_CR7","doi-asserted-by":"publisher","first-page":"294","DOI":"10.1016\/j.sysarc.2010.06.003","volume":"57","author":"I Chowdhury","year":"2011","unstructured":"Chowdhury I, Zulkernine M (2011) Using complexity, coupling, and cohesion metrics as early indicators of vulnerabilities. J Syst Architect (JSA) 57 (3):294\u2013313","journal-title":"J Syst Architect (JSA)"},{"key":"9951_CR8","unstructured":"Cohen J (1988) Statistical power analysis for the behavioral sciences. Routledge"},{"key":"9951_CR9","doi-asserted-by":"crossref","unstructured":"Cox J, Bouwers E, Eekelen M, Visser J (2015) Measuring dependency freshness in software systems. In: 2015 IEEE\/ACM 37th IEEE International Conference on Software Engineering (ICSE), pp 109\u2013118","DOI":"10.1109\/ICSE.2015.140"},{"key":"9951_CR10","doi-asserted-by":"crossref","unstructured":"Cram\u00e9r H (1946) Mathematical Methods of Statistics. Princeton University Press","DOI":"10.1515\/9781400883868"},{"key":"9951_CR11","doi-asserted-by":"crossref","unstructured":"Decan A, Mens T, Claes M (2017) An empirical comparison of dependency issues in OSS packaging ecosystems. In: Proceedings of the 24th International Conference on Software Analysis, Evolution, and Reengineering (SANER), pp 2\u201312","DOI":"10.1109\/SANER.2017.7884604"},{"key":"9951_CR12","doi-asserted-by":"crossref","unstructured":"Decan A, Mens T, Constantinou E (2018a) On the evolution of technical lag in the npm package dependency network. In: Proceedings of the 34th International Conference on Software Maintenance and Evolution (ICSME), pp 404\u2013414","DOI":"10.1109\/ICSME.2018.00050"},{"key":"9951_CR13","doi-asserted-by":"crossref","unstructured":"Decan A, Mens T, Constantinou E (2018b) On the impact of security vulnerabilities in the npm package dependency network. In: Proceedings of the 15th International Conference on Mining Software Repositories (MSR), pp 181\u2013191","DOI":"10.1145\/3196398.3196401"},{"key":"9951_CR14","doi-asserted-by":"crossref","unstructured":"Durumeric Z, Li F, Kasten J, Amann J, Beekman J, Payer M, Weaver N, Adrian D, Paxson V, Bailey M, Halderman J A (2014) The matter of heartbleed. In: Proceedings of the 2014 Conference on Internet Measurement Conference (IMC). ACM","DOI":"10.1145\/2663716.2663755"},{"key":"9951_CR15","unstructured":"GitHub (2017) About security alerts for vulnerable dependencies. https:\/\/help.github.com\/articles\/about-security-alerts-for-vulnerable-dependencies\/https:\/\/help.github.com\/articles\/about-security-alerts-for-vulnerable-dependencies\/. (Accessed on 02\/08\/2021)"},{"key":"9951_CR16","unstructured":"GitHub (2018a) How security alerts are keeping your code safer. https:\/\/github.blog\/2018-03-21-security-alerting-a-first-look-at-community-responses\/https:\/\/github.blog\/2018-03-21-security-alerting-a-first-look-at-community-responses\/. (Accessed on 02\/08\/2021)"},{"key":"9951_CR17","unstructured":"GitHub (2018b) Viewing and updating vulnerable dependencies in your repository. https:\/\/help.github.com\/articles\/viewing-and-updating-vulnerable-dependencies-in-your-repository\/. (Accessed on 02\/08\/2021)"},{"key":"9951_CR18","unstructured":"GitHub (2020) Keep all your packages up to date with dependabot - the github blog. https:\/\/github.blog\/2020-06-01-keep-all-your-packages-up-to-date-with-dependabot\/. (Accessed on 02\/08\/2021)"},{"key":"9951_CR19","unstructured":"Hejderup J (2015) In Dependencies We Trust: How vulnerable are dependencies in software modules?. Master\u2019s Thesis, Delft University of Technology"},{"key":"9951_CR20","doi-asserted-by":"crossref","unstructured":"Hora A, Robbes R, Anquetil N, Etien A, Ducasse S, Valente M T (2015) How Do Developers React to API Evolution? The Pharo Ecosystem Case. In: Proceedings of the 31st International Conference on Software Maintenance and Evolution (ICSME), pp 251\u2013260","DOI":"10.1109\/ICSM.2015.7332471"},{"key":"9951_CR21","unstructured":"Howard M, Leblanc D (2001) Writing Secure Code. Redmond, WA"},{"key":"9951_CR22","doi-asserted-by":"crossref","unstructured":"Ihara A, Fujibayashi D, Suwa H, Kula R G, Matsumoto K (2017) Understanding When to Adopt a Library: A Case Study on ASF Projects. In: Proceedings of the 13th International Conference on Open Source Systems (OSS), pp 128\u2013138","DOI":"10.1007\/978-3-319-57735-7_13"},{"key":"9951_CR23","doi-asserted-by":"crossref","unstructured":"Kikas R, Gousios G, Dumas M, Pfahl D (2017) Structure and Evolution of Package Dependency Networks. In: Proceedings of the 14th International Conference on Mining Software Repositories (MSR), pp 102\u2013112","DOI":"10.1109\/MSR.2017.55"},{"issue":"260","key":"9951_CR24","doi-asserted-by":"publisher","first-page":"583","DOI":"10.1080\/01621459.1952.10483441","volume":"47","author":"WH Kruskal","year":"1952","unstructured":"Kruskal W H, Wallis W A (1952) Use of Ranks in One-Criterion Variance Analysis. J Am Stat Assoc 47(260):583\u2013621","journal-title":"J Am Stat Assoc"},{"key":"9951_CR25","doi-asserted-by":"crossref","unstructured":"Kula R G, De Roover C, German D M, Ishio T, Inoue K (2018a) A generalized model for visualizing library popularity, adoption, and diffusion within a software ecosystem. In: Proceedings of the 25th International Conference on Software Analysis, Evolution and Reengineering (SANER), pp 288\u2013299","DOI":"10.1109\/SANER.2018.8330217"},{"key":"9951_CR26","doi-asserted-by":"crossref","unstructured":"Kula R G, German D M, Ouni A, Ishio T, Inoue K (February 2018b) Do developers update their library dependencies?. Empir Softw Eng (EMSE) 23(1):384\u2013417","DOI":"10.1007\/s10664-017-9521-5"},{"key":"9951_CR27","doi-asserted-by":"crossref","unstructured":"Lauinger T, Chaabane A, Arshad S, Robertson W, Wilson C, Kirda E (2017) Thou Shalt Not Depend on Me: Analysing the Use of Outdated JavaScript Libraries on the Web. In: Proceedings of the 24th Network and Distributed System Security Symposium (NDSS)","DOI":"10.14722\/ndss.2017.23414"},{"key":"9951_CR28","doi-asserted-by":"crossref","unstructured":"Li F, Paxson V (2017) A large-scale empirical study of security patches. In: Proceedings of the 24th ACM SIGSAC Conference on Computer and Communications Security (CCS), pp 2201\u20132215","DOI":"10.1145\/3133956.3134072"},{"key":"9951_CR29","doi-asserted-by":"crossref","unstructured":"Linares-V\u00e1squez M, Bavota G, Escobar-Vel\u00e1squez C (2017) An Empirical Study on Android-related Vulnerabilities. In: Proceedings of the 14th International Conference on Mining Software Repositories (MSR), pp 2\u201313","DOI":"10.1109\/MSR.2017.60"},{"key":"9951_CR30","doi-asserted-by":"crossref","unstructured":"Mirhosseini S, Parnin C (2017) Can automated pull requests encourage software developers to upgrade out-of-date dependencies?. In: Proceedings of the 32nd IEEE\/ACM International Conference on Automated Software Engineering (ASE), pp 84\u201394","DOI":"10.1109\/ASE.2017.8115621"},{"key":"9951_CR31","unstructured":"Mitre Corporation (2018a) CVE - Common Vulnerabilities and Exposures (CVE). https:\/\/cve.mitre.org\/. (Accessed on 02\/08\/2021)"},{"key":"9951_CR32","unstructured":"Mitre Corporation (2018b) CWE - Common Weakness Enumeration. https:\/\/cwe.mitre.org\/. (Accessed on 02\/08\/2021)"},{"issue":"3","key":"9951_CR33","doi-asserted-by":"publisher","first-page":"1305","DOI":"10.1007\/s10664-016-9447-3","volume":"22","author":"N Munaiah","year":"2017","unstructured":"Munaiah N, Camilo F, Wigham W, Meneely A, Nagappan M (2017) Do bugs foreshadow vulnerabilities? An in-depth study of the chromium project. Empir Softw Eng (EMSE) 22(3):1305\u20131347","journal-title":"Empir Softw Eng (EMSE)"},{"issue":"6","key":"9951_CR34","doi-asserted-by":"publisher","first-page":"2268","DOI":"10.1007\/s10664-015-9408-2","volume":"21","author":"VH Nguyen","year":"2016","unstructured":"Nguyen V H, Dashevskyi S, Massacci F (2016) An automatic method for assessing the versions affected by a vulnerability. Empir Softw Eng (EMSE) 21(6):2268\u20132297","journal-title":"Empir Softw Eng (EMSE)"},{"key":"9951_CR35","unstructured":"NPM (2016) Responding to Security Threats and Critical Updates . https:\/\/www.npmjs.com\/policies\/security#responding-to-security-threats-and-critical-updates. (Accessed on 02\/08\/2021)"},{"key":"9951_CR36","unstructured":"NPM (2018a) Auditing package dependencies for security vulnerabilities. https:\/\/docs.npmjs.com\/auditing-package-dependencies-for-security-vulnerabilities>. (Accessed on 02\/08\/2021)"},{"key":"9951_CR37","unstructured":"NPM (2018b) Security vulnerabilities found requiring manual review. https:\/\/docs.npmjs.com\/auditing-package-dependencies-for-security-vulnerabilities#security-vulnerabilities-found-requiring-manual-review. (Accessed on 02\/08\/2021)"},{"key":"9951_CR38","unstructured":"NPM (2010) npm. (Accessed on 02\/08\/2021)"},{"key":"9951_CR39","doi-asserted-by":"crossref","unstructured":"Pashchenko I, Plate H, Ponta S E, Sabetta A, Massacci F (2018) Vulnerable Open Source Dependencies: Counting Those That Matter. In: Proceedings of the 12th International Symposium on Empirical Software Engineering and Measurement (ESEM), pp 42:1\u201342:10","DOI":"10.1145\/3239235.3268920"},{"issue":"302","key":"9951_CR40","doi-asserted-by":"publisher","first-page":"157","DOI":"10.1080\/14786440009463897","volume":"50","author":"K Pearson","year":"1900","unstructured":"Pearson K (1900) X. on the criterion that a given system of deviations from the probable in the case of a correlated system of variables is such that it can be reasonably supposed to have arisen from random sampling. Lond Edinburgh Dubl Philos Mag J Sci 50(302):157\u2013175","journal-title":"Lond Edinburgh Dubl Philos Mag J Sci"},{"key":"9951_CR41","doi-asserted-by":"crossref","unstructured":"Piantadosi V, Scalabrino S, Oliveto R (2019) Fixing of security vulnerabilities in open source projects: A case study of apache http server and apache tomcat. In: Proceedings of the 12th IEEE Conference on Software Testing, Validation and Verification (ICST), pp 68\u201378","DOI":"10.1109\/ICST.2019.00017"},{"key":"9951_CR42","doi-asserted-by":"crossref","unstructured":"Ponta S E, Plate H, Sabetta A (2018) Beyond Metadata: Code-centric and Usage-based Analysis of Known Vulnerabilities in Open-source Software. In: Proceedings of the 34th International Conference on Software Maintenance and Evolution (ICSME), pp 58\u201368","DOI":"10.1109\/ICSME.2018.00054"},{"key":"9951_CR43","unstructured":"Preston-Werner T (2009) Semantic Versioning 2.0.0. https:\/\/semver.org\/. (Accessed on 02\/08\/2021)"},{"key":"9951_CR44","doi-asserted-by":"crossref","unstructured":"Raemaekers S, van Deursen A, Visser J (2012) Measuring software library stability through historical version analysis. In: Proceedings of the 28th International Conference on Software Maintenance (ICSM), pp 378\u2013387","DOI":"10.1109\/ICSM.2012.6405296"},{"key":"9951_CR45","doi-asserted-by":"crossref","unstructured":"Robbes R, Lungu M, R\u00f6thlisberger D (2012) How Do Developers React to API Deprecation?: The Case of a Smalltalk Ecosystem. In: Proceedings of the 20th International Symposium on the Foundations of Software Engineering (FSE), pp 56:1\u201356:11","DOI":"10.1145\/2393596.2393662"},{"key":"9951_CR46","unstructured":"Romano J, Kromrey J D, Coraggio J, Skowronek J, Devine L (2006) Exploring methods for evaluating group differences on the nsse and other surveys: Are the t-test and cohen\u2019sd indices the most appropriate choices. In: Annual meeting of the Southern Association for Institutional Research. Citeseer"},{"key":"9951_CR47","doi-asserted-by":"crossref","unstructured":"Sawant A A, Robbes R, Bacchelli A (2016) On the reaction to deprecation of 25,357 clients of 4 + 1 popular Java APIs. In: Proceedings of the 32th International Conference on Software Maintenance and Evolution (ICSME), pp 400\u2013410","DOI":"10.1109\/ICSME.2016.64"},{"key":"9951_CR48","doi-asserted-by":"crossref","unstructured":"Shin Y, Williams L (2008) An empirical model to predict security vulnerabilities using code complexity metrics. In: Proceedings of the 2nd International Symposium on Empirical Software Engineering and Measurement (ESEM), pp 315\u2013317","DOI":"10.1145\/1414004.1414065"},{"key":"9951_CR49","unstructured":"Snyk (2015) Vulnerability DB. https:\/\/snyk.io\/vuln. (Accessed on 02\/08\/2021)"},{"key":"9951_CR50","unstructured":"Snyk (2017a) Denial of Service (DoS) - npm:connect. https:\/\/snyk.io\/vuln\/npm:connect:20120107. (Accessed on 02\/08\/2021)"},{"key":"9951_CR51","unstructured":"Snyk (2017b) Insecure defaults in faye \u2014 snyk. https:\/\/snyk.io\/vuln\/npm:faye:20121107. (Accessed on 02\/08\/2021)"},{"key":"9951_CR52","unstructured":"Snyk (2017c) Symlink attack due to predictable tmp folder names in npm \u2014 snyk. https:\/\/snyk.io\/vuln\/npm:npm:20130708https:\/\/snyk.io\/vuln\/npm:npm:20130708. (Accessed on 02\/08\/2021)"},{"key":"9951_CR53","unstructured":"Synopsys (2014) Heartbleed Bug. http:\/\/heartbleed.com\/. (Accessed on 02\/08\/2021)"},{"key":"9951_CR54","doi-asserted-by":"crossref","unstructured":"Teyton C, Falleri J-R, Blanc X (2012) Mining Library Migration Graphs. In: Proceedings of the 19th Working Conference on Reverse Engineering (WCRE), pp 289\u2013298","DOI":"10.1109\/WCRE.2012.38"},{"issue":"5","key":"9951_CR55","doi-asserted-by":"publisher","first-page":"76","DOI":"10.1109\/MS.2018.290110854","volume":"35","author":"L Williams","year":"2018","unstructured":"Williams L, McGraw G, Migues S (2018) Engineering Security Vulnerability Prevention, Detection, and Response. IEEE Softw 35(5):76\u201380","journal-title":"IEEE Softw"},{"key":"9951_CR56","doi-asserted-by":"crossref","unstructured":"Wittern E, Suter P, Rajagopalan S (2016) A Look at the Dynamics of the JavaScript Package Ecosystem. In: Proceedings of the 13th International Conference on Mining Software Repositories (MSR), pp 351\u2013361","DOI":"10.1145\/2901739.2901743"},{"key":"9951_CR57","doi-asserted-by":"crossref","unstructured":"Zerouali A, Constantinou E, Mens T, Robles G, Gonzalez-Barahona J (2018) An empirical analysis of technical lag in npm package dependencies. In: Proceedings of the 17th International Conference on Software Reuse (ICSR), pp 95\u2013110","DOI":"10.1007\/978-3-319-90421-4_6"}],"container-title":["Empirical Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-021-09951-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10664-021-09951-x\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10664-021-09951-x.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2021,4,25]],"date-time":"2021-04-25T07:51:12Z","timestamp":1619337072000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10664-021-09951-x"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,3,30]]},"references-count":57,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2021,5]]}},"alternative-id":["9951"],"URL":"https:\/\/doi.org\/10.1007\/s10664-021-09951-x","relation":{},"ISSN":["1382-3256","1573-7616"],"issn-type":[{"value":"1382-3256","type":"print"},{"value":"1573-7616","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,3,30]]},"assertion":[{"value":"12 February 2021","order":1,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 March 2021","order":2,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}}],"article-number":"47"}}