{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:38:25Z","timestamp":1791459505075,"version":"4.3.4"},"reference-count":98,"publisher":"Association for Computing Machinery (ACM)","issue":"FSE","license":[{"start":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T00:00:00Z","timestamp":1750291200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"funder":[{"DOI":"10.13039\/100000001","name":"National Science Foundation","doi-asserted-by":"publisher","award":["2206859,2317168"],"award-info":[{"award-number":["2206859,2317168"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Proc. ACM Softw. Eng."],"published-print":{"date-parts":[[2025,6,19]]},"abstract":"<jats:p>\n                    Recent high-profile incidents in open-source software have greatly raised practitioner attention on software supply chain attacks. To guard against potential malicious package updates, security practitioners advocate\n                    <jats:italic toggle=\"yes\">pinning<\/jats:italic>\n                    dependency to specific versions rather than\n                    <jats:italic toggle=\"yes\">floating<\/jats:italic>\n                    in version ranges. However, it remains controversial whether pinning carries a meaningful security benefit that outweighs the cost of maintaining outdated and possibly vulnerable dependencies. In this paper, we quantify, through counterfactual analysis and simulations, the security and maintenance impact of version constraints in the npm ecosystem. By simulating dependency resolutions over historical time points, we find that pinning direct dependencies not only (as expected) increases the cost of maintaining vulnerable and outdated dependencies, but also (surprisingly) even increases the risk of exposure to malicious package updates in larger dependency graphs due to the specifics of npm\u2019s dependency resolution mechanism. Finally, we explore collective pinning strategies to secure the ecosystem against supply chain attacks, suggesting specific changes to npm to enable such interventions. Our study provides guidance for practitioners and tool designers to manage their supply chains more securely.\n                  <\/jats:p>","DOI":"10.1145\/3715728","type":"journal-article","created":{"date-parts":[[2025,6,19]],"date-time":"2025-06-19T11:16:02Z","timestamp":1750331762000},"page":"266-289","source":"Crossref","is-referenced-by-count":11,"title":["Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks"],"prefix":"10.1145","volume":"2","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8311-6559","authenticated-orcid":false,"given":"Hao","family":"He","sequence":"first","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4418-5783","authenticated-orcid":false,"given":"Bogdan","family":"Vasilescu","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4450-4572","authenticated-orcid":false,"given":"Christian","family":"K\u00e4stner","sequence":"additional","affiliation":[{"name":"Carnegie Mellon University, Pittsburgh, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2025,6,19]]},"reference":[{"key":"e_1_3_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER48275.2020.9054837"},{"key":"e_1_3_1_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106267"},{"key":"e_1_3_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR52588.2021.00037"},{"key":"e_1_3_1_5_1","doi-asserted-by":"publisher","DOI":"10.1145\/3447245"},{"key":"e_1_3_1_6_1","unstructured":"Josh Bressers. 2022. Fact vs. Feelings. Retrieved December 11 2023 from https:\/\/opensourcesecurity.io\/2022\/03\/21\/facts-vsfeelings\/"},{"key":"e_1_3_1_7_1","first-page":"327","volume-title":"The Sage Handbook of Regression Analysis and Causal Inference","author":"Br\u00fcderl Josef","year":"2015","unstructured":"Josef Br\u00fcderl and Volker Ludwig. 2015. Fixed-effects panel regression. In The Sage Handbook of Regression Analysis and Causal Inference. Sage, 327\u2013357."},{"key":"e_1_3_1_8_1","unstructured":"Checkmarx. 2023. NPM Account Takeover Results in Crypto Supply Chain Attack. Retrieved April 28 2024 from https:\/\/checkmarx.com\/blog\/npm-account-takeover-results-in-crypto-supply-chain-attack\/"},{"key":"e_1_3_1_9_1","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-021-09951-X"},{"key":"e_1_3_1_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2015.140"},{"key":"e_1_3_1_11_1","unstructured":"Yves Croissant Giovanni Millo Kevin Tappe Ott Toomet Christian Kleiber Achim Zeileis Arne Henningsen Liviu Andronic and Nina Schoenfelder. 2024. plm: Linear Models for Panel Data. Retrieved April 28 2024 from https:\/\/cran.rproject.org\/web\/packages\/plm"},{"key":"e_1_3_1_12_1","doi-asserted-by":"publisher","DOI":"10.1001\/archinte.159.17.2070"},{"key":"e_1_3_1_13_1","unstructured":"Mark Curphey. 2022. Dependency Pinning Only Works If You Actually Review the Updates. Retrieved December 11 2023 from https:\/\/crashoverride.com\/blog\/dependency-pinning-only-works-if-you-actually-review-the-updates"},{"key":"e_1_3_1_14_1","unstructured":"Erik DeBill. 2024. Modulecounts. Retrieved May 23 2024 from http:\/\/www.modulecounts.com\/"},{"key":"e_1_3_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2019.2918315"},{"key":"e_1_3_1_16_1","doi-asserted-by":"publisher","DOI":"10.1145\/3196398.3196401"},{"key":"e_1_3_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-017-9589-Y"},{"key":"e_1_3_1_18_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR.2019.00061"},{"key":"e_1_3_1_19_1","unstructured":"Nadia Eghbal. 2016. Roads and Bridges. The Unseen Labor Behind our Digital Infrastructure."},{"key":"e_1_3_1_20_1","unstructured":"ENISA. 2023. Good Practices for Supply Chain Cybersecurity. Retrieved August 27 2024 from https:\/\/www.enisa.europa.eu\/publications\/good-practices-for-supply-chain-cybersecurity"},{"key":"e_1_3_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397388"},{"issue":"4","key":"e_1_3_1_22_1","article-title":"For Good Measure: Counting Broken Links: A Quant\u2019s View of Software Supply Chain Security.","volume":"45","author":"Geer Dan","year":"2020","unstructured":"Dan Geer, Bentz Tozer, and John Speed Meyers. 2020. For Good Measure: Counting Broken Links: A Quant\u2019s View of Software Supply Chain Security. login Usenix Mag. 45, 4 (2020). https:\/\/www.usenix.org\/publications\/login\/winter2020\/geer","journal-title":"login Usenix Mag."},{"key":"e_1_3_1_23_1","doi-asserted-by":"publisher","DOI":"10.1037\/a0017543"},{"key":"e_1_3_1_24_1","unstructured":"GitHub. 2024. GitHub Advisory Database. Retrieved April 21 2024 from https:\/\/github.com\/advisories"},{"key":"e_1_3_1_25_1","unstructured":"Google. 2024. Assured Open Source Software. Retrieved September 8 2024 from https:\/\/cloud.google.com\/security\/products\/assured-open-source-software"},{"key":"e_1_3_1_26_1","unstructured":"Hacker News. 2017. Package Management: The problem with using version ranges. Retrieved December 11 2023 from https:\/\/news.ycombinator.com\/item?id=14759329"},{"key":"e_1_3_1_27_1","unstructured":"Hacker News. 2018. I have misgivings about all these version pinning... Retrieved December 13 2023 from https:\/\/news.ycombinator.com\/item?id=16422916"},{"key":"e_1_3_1_28_1","volume-title":"Introduction to Econometrics with R","author":"Hanck Christoph","year":"2021","unstructured":"Christoph Hanck, Martin Arnold, Alexander Gerber, and Martin Schmelzer. 2021. Regression with Panel Data. In Introduction to Econometrics with R. Universit\u00e4t Duisburg-Essen. https:\/\/www.econometrics-with-r.org\/10-rwpd.html"},{"key":"e_1_3_1_29_1","doi-asserted-by":"publisher","DOI":"10.1145\/3468264.3468571"},{"key":"e_1_3_1_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3278129"},{"key":"e_1_3_1_31_1","unstructured":"IBM. 2021. What is the Log4j vulnerability? Retrieved December 10 2023 from https:\/\/www.ibm.com\/topics\/log4j"},{"key":"e_1_3_1_32_1","unstructured":"Jay Jacobs Sasha Romanosky Benjamin Edwards Michael Roytman and Idris Adjerid. 2019. Exploit Prediction Scoring System (EPSS). CoRR abs\/1908.04856 (2019). http:\/\/arxiv.org\/abs\/1908.04856"},{"key":"e_1_3_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3106247"},{"key":"e_1_3_1_34_1","doi-asserted-by":"publisher","DOI":"10.1145\/3603110"},{"key":"e_1_3_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/3597926.3598147"},{"key":"e_1_3_1_36_1","unstructured":"Dezhen Kong Jiakun Liu Lingfeng Bao and David Lo. 2024. Towards Better Comprehension of Breaking Changes in the NPM Ecosystem. arXiv preprint arXiv:2408.14431 (2024). https:\/\/arxiv.org\/pdf\/2408.14431"},{"key":"e_1_3_1_37_1","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-017-9521-5"},{"key":"e_1_3_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.10179304"},{"key":"e_1_3_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556896"},{"key":"e_1_3_1_40_1","unstructured":"Max Leiter. 2023. Pin your npm\/yarn dependencies. Retrieved December 13 2023 from https:\/\/maxleiter.com\/blog\/pindependencies"},{"key":"e_1_3_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510142"},{"key":"e_1_3_1_42_1","unstructured":"Lucid. 2017. Package Management: Stop Using Version Ranges. Retrieved December 13 2023 from https:\/\/www.lucidchart.com\/techblog\/2017\/03\/15\/package-management-stop-using-version-ranges\/"},{"key":"e_1_3_1_43_1","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-020-09905-9"},{"key":"e_1_3_1_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2006.49"},{"key":"e_1_3_1_45_1","doi-asserted-by":"publisher","DOI":"10.18280\/ijsse.110505"},{"key":"e_1_3_1_46_1","doi-asserted-by":"publisher","DOI":"10.4230\/LIPICS.ECOOP.2018.7"},{"key":"e_1_3_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616293"},{"key":"e_1_3_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115621"},{"key":"e_1_3_1_49_1","volume-title":"Counterfactuals and causal inference","author":"Morgan Stephen L","year":"2015","unstructured":"Stephen L Morgan and Christopher Winship. 2015. Counterfactuals and causal inference. Cambridge University Press."},{"key":"e_1_3_1_50_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460319.3464797"},{"key":"e_1_3_1_51_1","unstructured":"npm. 2023a. About semantic versioning | npm Docs. Retrieved December 14 2023 from https:\/\/docs.npmjs.com\/aboutsemantic-versioning"},{"key":"e_1_3_1_52_1","unstructured":"npm. 2023b. npm. Retrieved December 11 2023 fromhttps:\/\/docs.npmjs.com\/about-npm"},{"key":"e_1_3_1_53_1","unstructured":"npm. 2023c. package-lock.json | npm Docs. Retrieved December 13 2023 from https:\/\/docs.npmjs.com\/cli\/v10\/configuringnpm\/package-lock-json"},{"key":"e_1_3_1_54_1","unstructured":"npm. 2024a. How npm3 Works. Retrieved April 28 2024 from https:\/\/npm.github.io\/how-npm-works-docs\/npm3\/hownpm3-works.html"},{"key":"e_1_3_1_55_1","unstructured":"npm. 2024b. npm-install | npm Docs. Retrieved April 17 2023 from https:\/\/docs.npmjs.com\/cli\/v8\/commands\/npm-install"},{"key":"e_1_3_1_56_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-52683-2_2"},{"key":"e_1_3_1_57_1","unstructured":"OpenSSF. 2023. OpenSSF Scorecard. Retrieved December 11 2023 from https:\/\/github.com\/ossf\/scorecard\/blob\/main\/docs\/checks.md#pinned-dependencies"},{"key":"e_1_3_1_58_1","doi-asserted-by":"publisher","DOI":"10.1145\/3239235.3268920"},{"key":"e_1_3_1_59_1","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417232"},{"key":"e_1_3_1_60_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSR59073.2023.00073"},{"key":"e_1_3_1_61_1","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3613094"},{"key":"e_1_3_1_62_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00124"},{"key":"e_1_3_1_63_1","unstructured":"Tom Preston-Werner. 2023. Semantic versioning 2.0.0. Retrieved December 11 2023 from https:\/\/semver.org\/"},{"key":"e_1_3_1_64_1","unstructured":"Maciej Radzikowski. 2021. Pin exact dependency versions. Retrieved December 13 2023 from https:\/\/betterdev.blog\/pinexact-dependency-versions\/"},{"key":"e_1_3_1_65_1","doi-asserted-by":"publisher","DOI":"10.1016\/J.JSS.2016.04.008"},{"key":"e_1_3_1_66_1","unstructured":"Matt Raible. 2019. Semantic Versioning Sucks! Long Live Semantic Versioning. Retrieved May 23 2024 from https:\/\/developer.okta.com\/blog\/2019\/12\/16\/semantic-versioning"},{"key":"e_1_3_1_67_1","unstructured":"Renovate Bot. 2018. Should you pin your JavaScript dependencies? Retrieved December 11 2023 from https:\/\/docs.renovatebot.com\/dependency-pinning"},{"key":"e_1_3_1_68_1","volume-title":"Organizational culture and leadership","author":"Schein Edgar H","year":"2010","unstructured":"Edgar H Schein. 2010. Organizational culture and leadership. Vol. 2. John Wiley & Sons."},{"key":"e_1_3_1_69_1","doi-asserted-by":"publisher","DOI":"10.1177\/26339137241231912"},{"key":"e_1_3_1_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/3510003.3510104"},{"key":"e_1_3_1_71_1","first-page":"111","article-title":"A practical guide to calculating Cohen\u2019s \ud835\udc53 2, a measure of local effect size, from PROC MIXED.","volume":"3","author":"Selya Arielle S","year":"2012","unstructured":"Arielle S Selya, Jennifer S Rose, Lisa C Dierker, Donald Hedeker, and Robin J Mermelstein. 2012. A practical guide to calculating Cohen\u2019s \ud835\udc53 2, a measure of local effect size, from PROC MIXED. Frontiers in Psychology 3 (2012), 111.","journal-title":"Frontiers in Psychology"},{"key":"e_1_3_1_72_1","doi-asserted-by":"publisher","DOI":"10.1145\/2568225.2568255"},{"key":"e_1_3_1_73_1","doi-asserted-by":"publisher","DOI":"10.1126\/science.236.4799.280"},{"key":"e_1_3_1_74_1","unstructured":"Snyk. 2022. Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine. Retrieved Augest 22 2023 from https:\/\/snyk.io\/blog\/peacenotwar-malicious-npm-node-ipc-package-vulnerability\/"},{"key":"e_1_3_1_75_1","unstructured":"Sonatype. 2021. Software supply chains: An introductory guide. Retrieved May 24 2024 from https:\/\/www.sonatype.com\/blog\/software-supply-chain-a-definition-and-introductory-guide"},{"key":"e_1_3_1_76_1","unstructured":"Sonatype. 2024a. 10th Annual State of the Software Supply Chain. Retrieved Jan 16 2025 from https:\/\/www.sonatype.com\/stateof-the-software-supply-chain\/2024"},{"key":"e_1_3_1_77_1","unstructured":"Sonatype. 2024b. CVE-2024-3094 The targeted backdoor supply chain attack against XZ and liblzma. Retrieved April 17 2024 from https:\/\/blog.sonatype.com\/cve-2024-3094-the-targeted-backdoor-supply-chain-attack-against-xz-and-liblzma"},{"key":"e_1_3_1_78_1","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387496"},{"key":"e_1_3_1_79_1","unstructured":"StackOverflow. 2017. Should I pin my Python dependencies versions? Retrieved December 13 2023 from https:\/\/stackoverflow.com\/questions\/28509481\/should-i-pin-my-python-dependencies-versions"},{"key":"e_1_3_1_80_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.socec.2005.11.043"},{"key":"e_1_3_1_81_1","unstructured":"TechTarget. 2023. SolarWinds hack explained: Everything you need to know. Retrieved May 22 2024 from https:\/\/www.techtarget.com\/whatis\/feature\/SolarWinds-hack-explained-Everything-you-need-to-know"},{"key":"e_1_3_1_82_1","unstructured":"The White House. 2021. Executive Order on Improving the Nation\u2019s Cybersecurity. Retrieved August 27 2024 from https:\/\/www.whitehouse.gov\/briefing-room\/presidential-actions\/2021\/05\/18\/executive-order-on-improving-thenations-cybersecurity\/"},{"key":"e_1_3_1_83_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00048"},{"key":"e_1_3_1_84_1","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236062"},{"key":"e_1_3_1_85_1","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409711"},{"key":"e_1_3_1_86_1","doi-asserted-by":"publisher","DOI":"10.1109\/EUROSPW51379.2020.00074"},{"key":"e_1_3_1_87_1","doi-asserted-by":"publisher","DOI":"10.1145\/3379597.3387465"},{"key":"e_1_3_1_88_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2023.3243262"},{"key":"e_1_3_1_89_1","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380426"},{"key":"e_1_3_1_90_1","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236056"},{"key":"e_1_3_1_91_1","unstructured":"Hyrum Wright. 2024. Hyrum\u2019s Law. Retrieved May 23 2024 from https:\/\/www.hyrumslaw.com\/"},{"key":"e_1_3_1_92_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE55515.2023.00066"},{"key":"e_1_3_1_93_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE56229.2023.00175"},{"key":"e_1_3_1_94_1","doi-asserted-by":"publisher","DOI":"10.1145\/2857705.2857750"},{"key":"e_1_3_1_95_1","doi-asserted-by":"publisher","unstructured":"Nusrat Zahan Philipp Burckhardt Mikola Lysenko Feross Aboukhadijeh and Laurie A. Williams. 2024. Shifting the Lens: Detecting Malware in npm Ecosystem with Large Language Models. CoRR abs\/2403.12196 (2024). https:\/\/doi.org\/10.48550\/ARXIV.2403.12196 10.48550\/ARXIV.2403.12196","DOI":"10.48550\/ARXIV.2403.12196"},{"key":"e_1_3_1_96_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSEC.2023.3279773"},{"key":"e_1_3_1_97_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP58684.2023.00032"},{"key":"e_1_3_1_98_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556956"},{"key":"e_1_3_1_99_1","first-page":"995","volume-title":"28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019","author":"Zimmermann Markus","year":"2019","unstructured":"Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small World with High Risks: A Study of Security Threats in the npm Ecosystem. In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019. USENIX Association, 995\u20131010. https:\/\/www.usenix.org\/conference\/usenixsecurity19\/"}],"container-title":["Proceedings of the ACM on Software Engineering"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3715728","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3715728","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,8,23]],"date-time":"2026-08-23T11:08:26Z","timestamp":1787483306000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3715728"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,6,19]]},"references-count":98,"journal-issue":{"issue":"FSE","published-print":{"date-parts":[[2025,6,19]]}},"alternative-id":["10.1145\/3715728"],"URL":"https:\/\/doi.org\/10.1145\/3715728","relation":{},"ISSN":["2994-970X"],"issn-type":[{"value":"2994-970X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025,6,19]]}}}