{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:35:35Z","timestamp":1791459335886,"version":"4.3.4"},"reference-count":58,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"4","license":[{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2023,4,1]],"date-time":"2023-04-01T00:00:00Z","timestamp":1680307200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"name":"NSA Science of Security Lablet"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IIEEE Trans. Software Eng."],"published-print":{"date-parts":[[2023,4,1]]},"DOI":"10.1109\/tse.2022.3181010","type":"journal-article","created":{"date-parts":[[2022,6,9]],"date-time":"2022-06-09T20:22:50Z","timestamp":1654806170000},"page":"1540-1560","source":"Crossref","is-referenced-by-count":22,"title":["Open or Sneaky? Fast or Slow? Light or Heavy?: Investigating Security Releases of Open Source Packages"],"prefix":"10.1109","volume":"49","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1955-1924","authenticated-orcid":false,"given":"Nasif","family":"Imtiaz","sequence":"first","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Aniqa","family":"Khanom","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3300-6540","authenticated-orcid":false,"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[{"name":"Department of Computer Science, North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref2","article-title":"2021 open source security and risk analysis report","year":"2021"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1145\/3347446"},{"key":"ref4","first-page":"995","article-title":"Small world with high risks: A study of security threats in the NPM ecosystem","volume-title":"Proc. 28th {USENIX} Secur. Symp.","author":"Zimmermann"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134072"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09951-x"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417232"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-017-9521-5"},{"key":"ref10","article-title":"What does this update do to my systems?\u2013An analysis of the importance of update-related information to system administrators","author":"Martius"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1016\/j.chb.2019.09.028"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1145\/3411495.3421360"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1145\/3468854"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ASE51524.2021.9678720"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2017.49"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2020.3038881"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/SANER50967.2021.00048"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1145\/3475716.3475769"},{"key":"ref25","article-title":"Writing a security advisory","author":"Maddox"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/3194653.3205288"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME46990.2020.00014"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/SANER.2017.7884604"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-019-09754-1"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1002\/smr.2157"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3387940.3392202"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/APSEC51365.2020.00031"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2018.00050"},{"key":"ref36","first-page":"181","article-title":"On the impact of security vulnerabilities in the NPM package dependency network","volume-title":"Proc. 15th Int. Conf. Mining Softw. Repositories","author":"Decan"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-09959-3"},{"key":"ref38","article-title":"In dependencies we trust: How vulnerable are dependencies in software modules?,","author":"Hejderup","year":"2015"},{"key":"ref39","article-title":"The dynamics of software composition analysis","author":"Foo","year":"2019"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1145\/1162666.1162671"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2012.6227141"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329849"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2019.2893950"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-022-10154-1"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/MSR52588.2021.00037"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2019.00040"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2016.2591536"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-015-9377-5"},{"key":"ref49","first-page":"273","article-title":"Keepers of the machines: Examining how system administrators manage software updates for multiple machines","volume-title":"Proc. 15th Symp. Usable Privacy Secur.","author":"Li"},{"key":"ref50","article-title":"Why do organizations trust Snyk to win the open source security battle?","author":"Catabi-Kalman","year":"2021"},{"key":"ref51","article-title":"How is a vulnerabilitys severity determined?"},{"key":"ref55","article-title":"The Art and Science of Learning From Data","volume-title":"","volume":"88","author":"Agresti","year":"2007"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2950325"},{"key":"ref59","article-title":"Open coding","author":"Khandkar","year":"2009"},{"key":"ref60","article-title":"An introduction to qualitative research","author":"Hancock","year":"2001","journal-title":"Trent Focus Group"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1108\/qrom-08-2016-1408"},{"key":"ref63","volume-title":"mvn-compare"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1214\/aoms\/1177730491"},{"key":"ref68","article-title":"Bonferroni correction","author":"Weisstein","year":"2004"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.2307\/1402731"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3117771"},{"key":"ref72","article-title":"Equifax data breach FAQ: What happened, who was affected, what was the impact?","author":"Fruhlinger","year":"2020"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2014.30"},{"key":"ref75","article-title":"A new process for CVE assignment","author":"Edge","year":"2017"},{"key":"ref76","article-title":"Collaborating in a temporary private fork to resolve a repository security vulnerability","year":"2022"},{"key":"ref79","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2021.3137674"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-015-9408-2"},{"key":"ref81","article-title":"Buying into the bias: Why vulnerability statistics suck","volume":"1","author":"Christey","year":"2013"}],"container-title":["IEEE Transactions on Software Engineering"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/32\/10103953\/09792380.pdf?arnumber=9792380","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,1]],"date-time":"2024-02-01T03:08:45Z","timestamp":1706756925000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/9792380\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,4,1]]},"references-count":58,"journal-issue":{"issue":"4"},"URL":"https:\/\/doi.org\/10.1109\/tse.2022.3181010","relation":{},"ISSN":["0098-5589","1939-3520","2326-3881"],"issn-type":[{"value":"0098-5589","type":"print"},{"value":"1939-3520","type":"electronic"},{"value":"2326-3881","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,4,1]]}}}