On the impact of security vulnerabilities in the npm and RubyGems dependency networks

The increasing interest in open source software has led to the emergence of large language-specific package distributions reusable libraries, such as npm and RubyGems. These packages can be subject vulnerabilities that may expose dependent through explicitly declared dependencies. Using Snyk’s vulnerability database, this article empirically studies affecting RubyGems packages. We analyse how when these are disclosed fixed, their prevalence changes over time. also vulnerable direct indirect dependents vulnerabilities. distinguish between two types dependents: distributed via manager, external GitHub projects depending on observe number is being faster than For both distributions, time required disclose Vulnerabilities affect a median 30 releases, while 59 releases A proportion exposed coming from or 33% 40% dependency which exposed, respectively, have fixes more recent within same major release range used dependency. Our findings reveal effort needed better secure distributions.