[논문 리뷰] Understanding npm Developers' Practices, Challenges, and Recommendations for Secure Package Development

Anthony Peruma, Truman Choy외 2명|arXiv (Cornell University)|2026. 01. 28.

Information and Cyber Security인용 수 0

한 줄 요약

이 논문은 npm 패키지 개발자 75명을 조사하여 보안 인식, 관행, 장벽, 및 npm 생태계 보안을 강화하기 위한 개선안을 이해합니다. 보안에 높은 가치를 두는 반면, 인식된 보안과 실제 패키지 보안 간의 차이, 도구 피로, 더 나은 도구와 교육의 필요성이 드러납니다.

ABSTRACT

Background: The Node Package Manager (npm) ecosystem plays a vital role in modern software development by providing a vast repository of packages and tools that developers can use to implement their software systems. However, recent vulnerabilities in third-party packages have led to serious security breaches, compromising the integrity of applications that depend on them. Objective: This study investigates how npm package developers perceive and handle security in their work. We examined developers' understanding of security risks, the practices and tools they use, the barriers to stronger security measures, and their suggestions for improving the npm ecosystem's security. Method: We conducted an online survey with 75 npm package developers and undertook a mixed-methods approach to analyzing their responses. Results: While developers prioritize security, they perceive their packages as only moderately secure, with concerns about supply chain attacks, dependency vulnerabilities, and malicious code. Only 40% are satisfied with the current npm security tools due to issues such as alert fatigue. Automated methods such as two-factor authentication and npm audit are favored over code reviews. Many drop dependencies due to abandonment or vulnerabilities, and typically respond to vulnerabilities in their packages by quickly releasing patches. Key barriers include time constraints and high false-positive rates. To improve npm security, developers seek better detection tools, clearer documentation, stronger account protections, and more education initiatives. Conclusion: Our findings will benefit npm package contributors and maintainers by highlighting prevalent security challenges and promoting discussions on best practices to strengthen security and trustworthiness within the npm landscape.

연구 동기 및 목표

• npm 개발자들이 자신들의 패키지에서 보안을 어떻게 인식하고 우선순위를 매기는지 평가한다.
• npm 개발자들이 일반적으로 사용하는 보안 관행과 도구를 식별한다.
• npm 패키지의 안전한 개발과 유지관리를 저해하는 장애물을 밝힌다.
• npm 패키지 보안을 강화하기 위한 개발자 우선 개선책을 수집한다.

제안 방법

• Qualtrics에서 26개의 질문으로 운영되는 응답자 주도 온라인 설문조사를 활용한다.
• 목적 표집을 사용하여 1,000명의 npm 패키지 개발자를 모집하고 75개의 완전 응답을 얻는다.
• 기술통계와 순위가 매겨진 문항에 대해 Borda Count를 사용하여 양적 데이터를 분석한다.
• 두 연구원이 신뢰성을 확보하기 위해 합의 협의를 거쳐 수작업으로 주제 코딩을 통해 질적 자유응답을 분석한다.
• 질문과 주제 간의 삼각분석을 위한 혼합 방법 분석을 적용한다.

Figure 1. Satisfaction with security tools for npm packages.

실험 결과

연구 질문

• RQ1 RQ1: How do npm developers perceive security for their packages?
• RQ2 RQ2: What security practices and tools do npm developers leverage in building and maintaining their packages?
• RQ3 RQ3: What barriers hinder the secure development and maintenance of npm packages?
• RQ4 RQ4: What improvements should be prioritized to strengthen security for npm packages?

주요 결과

• Developers regard security as important, yet most rate their own packages as only somewhat secure.
• Supply chain attacks and dependency vulnerabilities are top perceived threats in the npm ecosystem.
• Only 40% of respondents are satisfied with current npm security tools, with concerns about alert fatigue, usability gaps, and limited tool awareness.
• Automated practices (e.g., two-factor authentication, automated vulnerability scanning) are commonly adopted, while human-centered reviews and training are less frequent.
• Dependency hygiene decisions show many stop using dependencies due to abandonment or unpatched vulnerabilities, indicating maintenance and governance challenges.