[論文レビュー] Small World with High Risks: A Study of Security Threats in the npm Ecosystem

Markus Zimmermann, Cristian-Alexandru Staicu+2 more|arXiv (Cornell University)|Feb 25, 2019

Information and Cyber Security参考文献 31被引用数 89

ひとこと要約

The paper analyzes npm's dependency and maintainer networks to quantify security risks, showing high implicit trust and potential for wide-reaching attacks from few maintainers or popular packages. It also evaluates mitigation strategies like trusted maintainers and vetting to reduce risk.

ABSTRACT

The popularity of JavaScript has lead to a large ecosystem of third-party packages available via the npm software package registry. The open nature of npm has boosted its growth, providing over 800,000 free and reusable software packages. Unfortunately, this open nature also causes security risks, as evidenced by recent incidents of single packages that broke or attacked software running on millions of computers. This paper studies security risks for users of npm by systematically analyzing dependencies between packages, the maintainers responsible for these packages, and publicly reported security issues. Studying the potential for running vulnerable or malicious code due to third-party dependencies, we find that individual packages could impact large parts of the entire ecosystem. Moreover, a very small number of maintainer accounts could be used to inject malicious code into the majority of all packages, a problem that has been increasing over time. Studying the potential for accidentally using vulnerable code, we find that lack of maintenance causes many packages to depend on vulnerable code, even years after a vulnerability has become public. Our results provide evidence that npm suffers from single points of failure and that unmaintained packages threaten large code bases. We discuss several mitigation techniques, such as trusted maintainers and total first-party security, and analyze their potential effectiveness.

研究の動機と目的

• Quantify how dependencies and ecosystems grow in npm and how this growth affects security risk.
• Assess the influence of packages and maintainers on the ecosystem’s security surface.
• Investigate how vulnerabilities propagate through transitive dependencies and identify critical points of failure.
• Evaluate mitigation strategies to reduce risk for high-impact packages and maintainers.

提案手法

• Construct the npm dependency graph G_t from package metadata across time snapshots.
• Define and compute metrics: package reach (PR), implicitly trusted packages (ITP), maintainer reach (MR), and implicitly trusted maintainers (ITM).
• Model threats (malicious packages, unmaintained legacy code, package takeovers, account takeovers, collusion) and derive their risk exposure via the metrics.
• Analyze evolution over time using releases data (5,386,239 releases; 676,539 packages; 199,327 maintainers; 609 advisories).
• Assess vulnerability exposure using public advisories to define vulnerability reach (VR_t) and vulnerability reporting rate (VRR_t).

実験結果

リサーチクエスチョン

• RQ1 How connected and dense is the npm dependency network, and how does this evolve over time?
• RQ2 How many packages and maintainers can be implicitly trusted when a given package is installed or when a maintainer is compromised?
• RQ3 Which maintainers and packages pose the greatest reach and how does this change with ecosystem growth?
• RQ4 What portion of the ecosystem depends on vulnerable or unpatched code, and how rapidly are vulnerabilities reported?
• RQ5 What mitigation strategies are feasible to reduce risk without crippling ecosystem growth?

主な発見

• On average, installing an npm package implicitly trusts 79 third-party packages and 39 maintainers.
• Highly popular packages can influence hundreds of thousands of other packages, making them prime targets for malware.
• A very small number of compromised maintainer accounts can inject malware into a majority of packages, and this risk has grown over time.
• The ecosystem shows increasing package reach and maintainer reach, with some packages reaching over 100,000 other packages and maintainers reaching over 10,000 packages by 2018.
• Up to 40% of all packages depend on code with at least one publicly known vulnerability, highlighting substantial exposure to unpatched code.
• Mitigation options such as a vetted set of trusted maintainers could halve risk; vetting top 300 packages could also substantially reduce risk; aiming for perfect first- and third-party security remains challenging but informative for high-use packages.