{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,26]],"date-time":"2026-10-26T04:03:56Z","timestamp":1792987436204,"version":"4.5.0"},"reference-count":17,"publisher":"Elsevier BV","license":[{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/tdm\/userlicense\/1.0\/"},{"start":{"date-parts":[[2025,10,1]],"date-time":"2025-10-01T00:00:00Z","timestamp":1759276800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.elsevier.com\/legal\/tdmrep-license"},{"start":{"date-parts":[[2025,7,11]],"date-time":"2025-07-11T00:00:00Z","timestamp":1752192000000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100009042","name":"University of Seville","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100009042","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001872","name":"Centro para el Desarrollo Tecnol\u00f3gico Industrial","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100001872","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100011033","name":"Agencia Estatal de Investigaci\u00f3n","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100011033","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100002924","name":"Federaci\u00f3n Espa\u00f1ola de Enfermedades Raras","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100002924","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/100014440","name":"Ministerio de Ciencia, Innovaci\u00f3n y Universidades","doi-asserted-by":"publisher","id":[{"id":"10.13039\/100014440","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100011011","name":"Junta de Andaluc\u00eda","doi-asserted-by":"publisher","id":[{"id":"10.13039\/501100011011","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["elsevier.com","sciencedirect.com"],"crossmark-restriction":true},"short-container-title":["Data in Brief"],"published-print":{"date-parts":[[2025,10]]},"DOI":"10.1016\/j.dib.2025.111903","type":"journal-article","created":{"date-parts":[[2025,7,21]],"date-time":"2025-07-21T16:55:14Z","timestamp":1753116914000},"page":"111903","update-policy":"https:\/\/doi.org\/10.1016\/elsevier_cm_policy","source":"Crossref","is-referenced-by-count":3,"special_numbering":"C","title":["A dataset on vulnerabilities affecting dependencies in software package managers"],"prefix":"10.1016","volume":"62","author":[{"given":"A. Germ\u00e1n","family":"M\u00e1rquez","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9953-6005","authenticated-orcid":false,"given":"\u00c1ngel Jes\u00fas","family":"Varela-Vaca","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3562-875X","authenticated-orcid":false,"given":"Mar\u00eda Teresa","family":"G\u00f3mez L\u00f3pez","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"78","reference":[{"key":"10.1016\/j.dib.2025.111903_bib0001","article-title":"Data in brief material for experimental reproducibility","author":"M\u00e1rquez Trujillo","year":"2025","journal-title":"Zenodo"},{"key":"10.1016\/j.dib.2025.111903_bib0002","doi-asserted-by":"crossref","DOI":"10.1016\/j.cose.2023.103669","article-title":"Vulnerability impact analysis in software project dependencies based on satisfiability modulo theories (SMT)","volume":"139","author":"Germ\u00e1n M\u00e1rquez","year":"2024","journal-title":"Comput. Secur."},{"key":"10.1016\/j.dib.2025.111903_bib0003","unstructured":"\u2018npm | Home\u2019. Accessed: May 20, 2025. [Online]. Available: https:\/\/www.npmjs.com\/."},{"key":"10.1016\/j.dib.2025.111903_bib0004","unstructured":"\u2018PyPI \u00b7 El \u00cdndice de paquetes de Python\u2019, PyPI. Accessed: May 20, 2025. [Online]. Available: https:\/\/pypi.org\/."},{"key":"10.1016\/j.dib.2025.111903_bib0005","unstructured":"\u2018crates.Io: rust package registry\u2019. Accessed: May 20, 2025. [Online]. Available: https:\/\/crates.io\/."},{"key":"10.1016\/j.dib.2025.111903_bib0006","unstructured":"\u2018RubyGems.Org | el alojamiento de gemas de tu comunidad\u2019. Accessed: May 20, 2025. [Online]. Available: https:\/\/rubygems.org\/?locale=es."},{"key":"10.1016\/j.dib.2025.111903_bib0007","unstructured":"\u2018OSV - open source vulnerabilities\u2019. Accessed: May 20, 2025. [Online]. Available: https:\/\/osv.dev\/."},{"issue":"1","key":"10.1016\/j.dib.2025.111903_bib0008","doi-asserted-by":"crossref","first-page":"381","DOI":"10.1007\/s10664-017-9589-y","article-title":"An empirical comparison of dependency network evolution in seven software packaging ecosystems","volume":"24","author":"Decan","year":"2019","journal-title":"Empir. Softw. Eng."},{"issue":"2","key":"10.1016\/j.dib.2025.111903_bib0009","doi-asserted-by":"crossref","first-page":"96","DOI":"10.1109\/MSEC.2022.3142338","article-title":"Top five challenges in software supply chain security: observations from 30 industry and government organizations","volume":"20","author":"Enck","year":"2022","journal-title":"IEEE Secur. Priv."},{"key":"10.1016\/j.dib.2025.111903_bib0010","unstructured":"I. Rahman, N. Zahan, S. Magill, W. Enck, and L. Williams, \u2018Characterizing dependency update practice of NPM, PyPI and cargo packages\u2019, Mar. 26, 2024, arXiv: arXiv:2403.17382. doi: 10.48550\/arXiv.2403.17382."},{"key":"10.1016\/j.dib.2025.111903_bib0011","doi-asserted-by":"crossref","DOI":"10.1145\/3714464","article-title":"Research directions in software supply chain security","author":"Williams","year":"2025","journal-title":"ACM Trans Softw Eng Methodol"},{"key":"10.1016\/j.dib.2025.111903_bib0012","series-title":"2021 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER)","first-page":"446","article-title":"Empirical analysis of security vulnerabilities in python packages","author":"Alfadel","year":"2021"},{"key":"10.1016\/j.dib.2025.111903_bib0013","doi-asserted-by":"crossref","unstructured":"W. Guo, Z. Xu, C. Liu, C. Huang, Y. Fang, and Y. Liu, \u2018An empirical study of malicious code In PyPI ecosystem\u2019, Sep. 20, 2023, arXiv: arXiv:2309.11021. doi: 10.48550\/arXiv.2309.11021.","DOI":"10.1109\/ASE56229.2023.00135"},{"issue":"5","key":"10.1016\/j.dib.2025.111903_bib0014","doi-asserted-by":"crossref","first-page":"107","DOI":"10.1007\/s10664-022-10154-1","article-title":"On the impact of security vulnerabilities in the npm and RubyGems dependency networks","volume":"27","author":"Zerouali","year":"2022","journal-title":"Empir. Softw. Eng."},{"key":"10.1016\/j.dib.2025.111903_bib0015","doi-asserted-by":"crossref","first-page":"67","DOI":"10.1016\/j.future.2020.03.033","article-title":"A methodology for conducting efficient sanitization of HTTP training datasets","volume":"109","author":"D\u00edaz-Verdejo","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"issue":"7","key":"10.1016\/j.dib.2025.111903_bib0016","doi-asserted-by":"crossref","first-page":"9986","DOI":"10.1007\/s11227-023-05843-7","article-title":"Iot traffic-based DDoS attacks detection mechanisms: a comprehensive review","volume":"80","author":"Shukla","year":"2024","journal-title":"J. Supercomput."},{"key":"10.1016\/j.dib.2025.111903_bib0017","series-title":"Experimentation in Software Engineering","author":"Wohlin","year":"2024"}],"container-title":["Data in Brief"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2352340925006274?httpAccept=text\/xml","content-type":"text\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/api.elsevier.com\/content\/article\/PII:S2352340925006274?httpAccept=text\/plain","content-type":"text\/plain","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T05:26:45Z","timestamp":1772774805000},"score":1,"resource":{"primary":{"URL":"https:\/\/linkinghub.elsevier.com\/retrieve\/pii\/S2352340925006274"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10]]},"references-count":17,"alternative-id":["S2352340925006274"],"URL":"https:\/\/doi.org\/10.1016\/j.dib.2025.111903","relation":{"is-supplemented-by":[{"id-type":"doi","id":"10.5281\/zenodo.15432733","asserted-by":"subject"}]},"ISSN":["2352-3409"],"issn-type":[{"value":"2352-3409","type":"print"}],"subject":[],"published":{"date-parts":[[2025,10]]},"assertion":[{"value":"Elsevier","name":"publisher","label":"This article is maintained by"},{"value":"A dataset on vulnerabilities affecting dependencies in software package managers","name":"articletitle","label":"Article Title"},{"value":"Data in Brief","name":"journaltitle","label":"Journal Title"},{"value":"https:\/\/doi.org\/10.1016\/j.dib.2025.111903","name":"articlelink","label":"CrossRef DOI link to publisher maintained version"},{"value":"https:\/\/doi.org\/10.1016\/j.cose.2023.103669","name":"associatedlink","label":"CrossRef DOI link to the associated document"},{"value":"simple-article","name":"content_type","label":"Content Type"},{"value":"\u00a9 2025 The Authors. Published by Elsevier Inc.","name":"copyright","label":"Copyright"}],"article-number":"111903"}}