{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T15:59:05Z","timestamp":1785340745371,"version":"3.55.0"},"publisher-location":"New York, NY, USA","reference-count":45,"publisher":"ACM","license":[{"start":{"date-parts":[[2027,7,29]],"date-time":"2027-07-29T00:00:00Z","timestamp":1816819200000},"content-version":"vor","delay-in-days":654,"URL":"http:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"funder":[{"DOI":"10.13039\/100000001","name":"NSF (National Science Foundation)","doi-asserted-by":"publisher","award":["2207008"],"award-info":[{"award-number":["2207008"]}],"id":[{"id":"10.13039\/100000001","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2025,10,13]]},"DOI":"10.1145\/3733827.3765528","type":"proceedings-article","created":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T12:47:16Z","timestamp":1785329236000},"page":"46-56","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Aggregating Security Measures from the Dependency Tree"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-5881-4619","authenticated-orcid":false,"given":"Sarah","family":"Elder","sequence":"first","affiliation":[{"name":"North Carolina State University, Raleigh, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0001-5392-2573","authenticated-orcid":false,"given":"Alexander","family":"Klevans","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6682-4243","authenticated-orcid":false,"given":"Ranindya","family":"Paramitha","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1323-8769","authenticated-orcid":false,"given":"Marcelo","family":"d'Amorim","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3300-6540","authenticated-orcid":false,"given":"Laurie","family":"Williams","sequence":"additional","affiliation":[{"name":"North Carolina State University, Raleigh, NC, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,7,29]]},"reference":[{"key":"e_1_3_3_2_2_2","doi-asserted-by":"publisher","DOI":"10.1145\/3106237.3106267"},{"key":"e_1_3_3_2_3_2","doi-asserted-by":"crossref","unstructured":"Rabe Abdalkareem Vinicius Oda Suhaib Mujahid and Emad Shihab. 2020. On the impact of using trivial packages: An empirical case study on npm and pypi. Empirical Software Engineering 25 (2020) 1168\u20131204.","DOI":"10.1007\/s10664-019-09792-9"},{"key":"e_1_3_3_2_4_2","unstructured":"Authors. 2025. Our dataset. https:\/\/osf.io\/x9hzs\/?view_only=482febb8d30141aea8abbe1f8ad461d8."},{"key":"e_1_3_3_2_5_2","volume-title":"Statistical Power Analysis for the Behavioral Sciences (2nd ed.)","author":"Cohen Jacob","year":"1988","unstructured":"Jacob Cohen. 1988. Statistical Power Analysis for the Behavioral Sciences (2nd ed.). Routledge."},{"key":"e_1_3_3_2_6_2","volume-title":"Quasi-Experimentation: Design and Analysis Issues for Field Settings","author":"Cook Thomas\u00a0D.","year":"1979","unstructured":"Thomas\u00a0D. Cook and Donald\u00a0T. Campbell. 1979. Quasi-Experimentation: Design and Analysis Issues for Field Settings. Rand McNally College Publishing."},{"key":"e_1_3_3_2_7_2","doi-asserted-by":"publisher","unstructured":"Russ Cox Robert Griesemer Rob Pike Ian\u00a0Lance Taylor and Ken Thompson. 2022. The Go programming language and environment. Commun. ACM 65 5 (apr 2022) 70\u201378. 10.1145\/3488716","DOI":"10.1145\/3488716"},{"key":"e_1_3_3_2_8_2","doi-asserted-by":"publisher","DOI":"10.1145\/3273934.3273937"},{"key":"e_1_3_3_2_9_2","volume-title":"Probability and Statistics for Engineering and the Sciences (ninth ed.)","author":"Devore Jay\u00a0L","year":"2014","unstructured":"Jay\u00a0L Devore. 2014. Probability and Statistics for Engineering and the Sciences (ninth ed.). Cengage Learning."},{"key":"e_1_3_3_2_10_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-64171-8_18"},{"key":"e_1_3_3_2_11_2","doi-asserted-by":"crossref","unstructured":"Olive\u00a0Jean Dunn. 1961. Multiple comparisons among means. Journal of the American statistical association 56 293 (1961) 52\u201364.","DOI":"10.1080\/01621459.1961.10482090"},{"key":"e_1_3_3_2_12_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-1-4419-0118-71"},{"key":"e_1_3_3_2_13_2","doi-asserted-by":"publisher","unstructured":"Sarah Elder Md\u00a0Rayhanur Rahman Gage Fringer Kunal Kapoor and Laurie Williams. 2024. A Survey on Software Vulnerability Exploitability Assessment. ACM Comput. Surv. 56 8 Article 205 (April 2024) 41\u00a0pages. 10.1145\/3648610","DOI":"10.1145\/3648610"},{"key":"e_1_3_3_2_14_2","first-page":"374","volume-title":"Seke","author":"Feldt Robert","year":"2010","unstructured":"Robert Feldt and Ana Magazinius. 2010. Validity threats in empirical software engineering research-an initial survey.. In Seke. 374\u2013379."},{"key":"e_1_3_3_2_15_2","unstructured":"Go. 2024. Why Go -> Case Studies (Website). https:\/\/go.dev\/solutions\/case-studies Online; Accessed: 22-July-2024."},{"key":"e_1_3_3_2_16_2","unstructured":"GO. 2025. Why Go > Case Studies. https:\/\/go.dev\/solutions\/case-studies."},{"key":"e_1_3_3_2_17_2","doi-asserted-by":"crossref","unstructured":"Jelle\u00a0J Goeman and Aldo Solari. 2014. Tutorial in biostatistics: multiple hypothesis testing in genomics. Statistics in Medicine (2014).","DOI":"10.1002\/sim.6082"},{"key":"e_1_3_3_2_18_2","unstructured":"Jawad Golzar Shagofah Noor and Omid Tajik. 2022. Convenience sampling. International Journal of Education & Language Studies 1 2 (2022) 72\u201377."},{"key":"e_1_3_3_2_19_2","unstructured":"Google. 2024. Open Source Insights (website). https:\/\/deps.dev\/ Online; Accessed: 22-July-2024."},{"key":"e_1_3_3_2_20_2","unstructured":"Google. 2024. Open Source Insights (website). https:\/\/docs.deps.dev\/faq\/ Online; Accessed: 22-July-2024."},{"key":"e_1_3_3_2_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639230"},{"key":"e_1_3_3_2_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3368089.3409711"},{"key":"e_1_3_3_2_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556896"},{"key":"e_1_3_3_2_24_2","doi-asserted-by":"publisher","DOI":"10.1109\/RAM.2017.7889792"},{"key":"e_1_3_3_2_25_2","doi-asserted-by":"publisher","unstructured":"Xiaozhou Li Sergio Moreschini Zheying Zhang and Davide Taibi. 2022. Exploring factors and metrics to select open source software components for integration: An empirical study. Journal of Systems and Software 188 (2022) 111255. 10.1016\/j.jss.2022.111255","DOI":"10.1016\/j.jss.2022.111255"},{"key":"e_1_3_3_2_26_2","doi-asserted-by":"crossref","unstructured":"Henry\u00a0B Mann and Donald\u00a0R Whitney. 1947. On a test of whether one of two random variables is stochastically larger than the other. The annals of mathematical statistics (1947) 50\u201360.","DOI":"10.1214\/aoms\/1177730491"},{"key":"e_1_3_3_2_27_2","doi-asserted-by":"publisher","unstructured":"Suhaib Mujahid Rabe Abdalkareem and Emad Shihab. 2023. What are the characteristics of highly-selected packages? A case study on the npm ecosystem. Journal of Systems and Software 198 (2023) 111588. 10.1016\/j.jss.2022.111588","DOI":"10.1016\/j.jss.2022.111588"},{"key":"e_1_3_3_2_28_2","doi-asserted-by":"crossref","unstructured":"Sarah Nadi and Nourhan Sakr. 2023. Selecting third-party libraries: the data scientist\u2019s perspective. Empirical Software Engineering 28 1 (2023) 15.","DOI":"10.1007\/s10664-022-10241-3"},{"key":"e_1_3_3_2_29_2","unstructured":"OpenSSF. 2024. About - Open Source Security Foundation. https:\/\/openssf.org\/about\/ Online; Accessed: 08-Jun-2024."},{"key":"e_1_3_3_2_30_2","unstructured":"OpenSSF. 2024. OpenSSF Scorecard (Website). https:\/\/securityscorecards.dev [Online; Accessed: 30-Sept-2024]."},{"key":"e_1_3_3_2_31_2","unstructured":"OpenSSF. 2025. OpenSSF Scorecard Checks Summary (Website). https:\/\/github.com\/ossf\/scorecard?tab=readme-ov-file#scorecard-checks [Online; Accessed: 23-Aug-2025]."},{"key":"e_1_3_3_2_32_2","unstructured":"OpenSSF. 2025. OpenSSF Scorecard Checks (Website). https:\/\/github.com\/ossf\/scorecard\/blob\/main\/docs\/checks.md [Online; Accessed: 12-July-2025]."},{"key":"e_1_3_3_2_33_2","unstructured":"OpenSSF. 2025. OpenSSF Scorecard README (Website). https:\/\/github.com\/ossf\/scorecard\/blob\/main\/README.md [Online; Accessed: 09-July-2025]."},{"key":"e_1_3_3_2_34_2","unstructured":"OSV. 2024. Open Source Vulnerabilities (Website). https:\/\/osv.dev\/ Online; Accessed: 22-July-2024."},{"key":"e_1_3_3_2_35_2","doi-asserted-by":"publisher","DOI":"10.1145\/3239235.3268920"},{"key":"e_1_3_3_2_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3372297.3417232"},{"key":"e_1_3_3_2_37_2","unstructured":"Qualtrics. 2024. Qualtrics (Website). https:\/\/www.qualtrics.com\/ Online; Accessed: 22-July-2024."},{"key":"e_1_3_3_2_38_2","doi-asserted-by":"publisher","DOI":"10.1145\/3210459.3210461"},{"key":"e_1_3_3_2_39_2","doi-asserted-by":"publisher","DOI":"10.1109\/ISSREW.2019.00039"},{"key":"e_1_3_3_2_40_2","doi-asserted-by":"publisher","DOI":"10.1109\/SP46215.2023.00191"},{"key":"e_1_3_3_2_41_2","doi-asserted-by":"publisher","DOI":"10.5555\/2349018"},{"key":"e_1_3_3_2_42_2","doi-asserted-by":"crossref","unstructured":"Bowen Xu Le An Ferdian Thung Foutse Khomh and David Lo. 2020. Why reinventing the wheels? An empirical study on library reuse and re-implementation. Empirical Software Engineering 25 (2020) 755\u2013789.","DOI":"10.1007\/s10664-019-09771-0"},{"key":"e_1_3_3_2_43_2","doi-asserted-by":"publisher","unstructured":"Nusrat Zahan Parth Kanakiya Brian Hambleton Shohanuzzaman Shohan and Laurie Williams. 2023. OpenSSF Scorecard: On the Path Toward Ecosystem-Wide Automated Security Metrics. IEEE Security & Privacy 21 6 (2023) 76\u201388. 10.1109\/MSEC.2023.3279773","DOI":"10.1109\/MSEC.2023.3279773"},{"key":"e_1_3_3_2_44_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-SEIP58684.2023.00032"},{"key":"e_1_3_3_2_45_2","doi-asserted-by":"crossref","unstructured":"Ahmed Zerouali Tom Mens Alexandre Decan and Coen De\u00a0Roover. 2022. On the impact of security vulnerabilities in the npm and rubygems dependency networks. Empirical Software Engineering 27 5 (2022) 107.","DOI":"10.1007\/s10664-022-10154-1"},{"key":"e_1_3_3_2_46_2","volume-title":"USENIX security symposium","author":"Zimmermann Markus","year":"2019","unstructured":"Markus Zimmermann, Cristian-Alexandru Staicu, Cam Tenny, and Michael Pradel. 2019. Small World with High Risks: A Study of Security Threats in the npm Ecosystem.. In USENIX security symposium , Vol.\u00a017."}],"event":{"name":"SCORED '25: Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses","location":"Taipei , Taiwan","acronym":"SCORED '25","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 2025 Workshop on Software Supply Chain Offensive Research and Ecosystem Defenses"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3733827.3765528","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3733827.3765528","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,29]],"date-time":"2026-07-29T15:12:01Z","timestamp":1785337921000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3733827.3765528"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,13]]},"references-count":45,"alternative-id":["10.1145\/3733827.3765528","10.1145\/3733827"],"URL":"https:\/\/doi.org\/10.1145\/3733827.3765528","relation":{},"subject":[],"published":{"date-parts":[[2025,10,13]]},"assertion":[{"value":"2026-07-29","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}