[Paper Review] On The Lag of Library Vulnerability Updates: An Investigation into the Repackage and Delivery of Security Fixes Within The npm JavaScript Ecosystem

Bodin Chinthanet, Raula Gaikovina Kula+3 more|arXiv (Cornell University)|Jul 8, 2019

Software Engineering Research4 citations

TL;DR

This study investigates delays in vulnerability fix updates within the npm JavaScript ecosystem, identifying two key lags: repackaging delays due to bundling fixes with unrelated changes (83.33% of commits unrelated), and delivery delays where clients prefer minor over patch updates. The findings reveal that severity and downstream dependencies influence adoption, but package freshness does not, offering insights for improving fix propagation in software ecosystems.

ABSTRACT

Vulnerabilities in third-party libraries is a growing concern for the software developer, as it poses risks not only to the software client itself but to the entire software ecosystem. To mitigate these risks, developers are strongly recommended to update their dependencies. Recent studies show that affected developers are not likely to respond to the vulnerability threat. However, another reason for the lag of vulnerability updates is due to slow repackaging (i.e., package the vulnerability fix into a new version) and delivery (i.e., affected client adopt the new version) of the fix. To understand these lags of updates, we use both qualitative and quantitative approaches to conduct an empirical study on how 188 fixes were repackaged and delivered across over eight hundred thousand releases of npm software clients hosted on GitHub. We report two lags: (1) lags in repackaging occur as vulnerability fixes are more likely to be bundled with other non-related updates (i.e., about 83.33\% of commits are not related to the fix) and (2) lags in the delivery are caused by clients that are more likely to adopt the minor fix than adopt the patch fix. Furthermore, other factors such as downstream dependencies and severity do have an impact. We also find that freshness of packages does not impact the amount of lags. The identification of these two lags opens up different avenues on how to facilitate faster fix delivery throughout a library ecosystem.

Motivation & Objective

• To investigate the root causes of delayed vulnerability fix updates in the npm JavaScript ecosystem.
• To analyze the time lag between vulnerability disclosure and the repackaging of fixes into new library versions.
• To examine client-side adoption patterns of vulnerability fixes, particularly differences between patch and minor version updates.
• To assess the influence of factors such as severity, downstream dependencies, and package freshness on update timing.
• To identify systemic bottlenecks in the vulnerability fix delivery pipeline for software libraries.

Proposed method

• Conducted an empirical study on 188 vulnerability fixes across over 800,000 npm client releases hosted on GitHub.
• Used version control analysis to measure the time lag between vulnerability disclosure and the repackaging of fixes into new library versions.
• Tracked client adoption rates by comparing the frequency of patch versus minor version updates following fix releases.
• Applied qualitative and quantitative analysis to classify commit content and determine whether fixes were bundled with unrelated changes.
• Evaluated the impact of severity levels and downstream dependency chains on update timing.
• Measured the effect of package freshness (i.e., time since first release) on repackaging and delivery lags.

Experimental results

Research questions

• RQ1 How long does it typically take for a vulnerability fix to be repackaged into a new version of a library after disclosure?
• RQ2 To what extent are vulnerability fixes bundled with unrelated changes during repackaging?
• RQ3 Why do clients prefer adopting minor version updates over patch version updates for the same fix?
• RQ4 How do severity levels and downstream dependencies affect the speed of fix adoption?
• RQ5 Does the freshness of a package influence the speed of repackaging or delivery of vulnerability fixes?

Key findings

• Approximately 83.33% of commits that include a vulnerability fix also contain unrelated changes, significantly delaying the repackaging of security fixes.
• Clients are more than twice as likely to adopt a minor version update than a patch version update for the same vulnerability fix, indicating a preference for non-minor updates.
• The severity of a vulnerability has a measurable impact on the speed of fix delivery, with higher-severity issues being adopted more quickly.
• Downstream dependencies influence update timing, as libraries with more dependent projects experience faster fix adoption due to increased scrutiny.
• Package freshness does not significantly affect the magnitude of repackaging or delivery lags, suggesting that newer packages are not inherently faster to update.
• The study identifies two distinct lags—repackaging and delivery—that together contribute to prolonged exposure to vulnerabilities in the npm ecosystem.