[论文解读] Understanding npm Developers' Practices, Challenges, and Recommendations for Secure Package Development

Anthony Peruma, Truman Choy+2 more|arXiv (Cornell University)|Jan 28, 2026

Information and Cyber Security被引用 0

一句话总结

本论文对75位 npm 包开发者进行调查，以了解他们对安全的认知、实践、障碍及对加强 npm 生态系统安全的建议。研究发现开发者高度重视安全，但感知的安全性与实际包安全性之间存在差距，工具疲劳问题以及对更好工具和教育的需求。

ABSTRACT

Background: The Node Package Manager (npm) ecosystem plays a vital role in modern software development by providing a vast repository of packages and tools that developers can use to implement their software systems. However, recent vulnerabilities in third-party packages have led to serious security breaches, compromising the integrity of applications that depend on them. Objective: This study investigates how npm package developers perceive and handle security in their work. We examined developers' understanding of security risks, the practices and tools they use, the barriers to stronger security measures, and their suggestions for improving the npm ecosystem's security. Method: We conducted an online survey with 75 npm package developers and undertook a mixed-methods approach to analyzing their responses. Results: While developers prioritize security, they perceive their packages as only moderately secure, with concerns about supply chain attacks, dependency vulnerabilities, and malicious code. Only 40% are satisfied with the current npm security tools due to issues such as alert fatigue. Automated methods such as two-factor authentication and npm audit are favored over code reviews. Many drop dependencies due to abandonment or vulnerabilities, and typically respond to vulnerabilities in their packages by quickly releasing patches. Key barriers include time constraints and high false-positive rates. To improve npm security, developers seek better detection tools, clearer documentation, stronger account protections, and more education initiatives. Conclusion: Our findings will benefit npm package contributors and maintainers by highlighting prevalent security challenges and promoting discussions on best practices to strengthen security and trustworthiness within the npm landscape.

研究动机与目标

• 评估 npm 开发者如何感知和优先考虑其包的安全性。
• 识别 npm 开发者在构建与维护中常用的安全实践与工具。
• 揭示阻碍安全开发与维护 npm 包的障碍。
• 收集开发者优先的改进意见，以加强 npm 包的安全性。

提出的方法

• 在 Qualtrics 上托管的以 respondent 为驱动的在线调查，包含26个问题。
• 采用定向抽样招募1000名 npm 包开发者并获得75份完整回复。
• 用描述性统计对定量数据进行分析，并对排序问题使用博尔达计数。
• 通过两名研究者对自由文本回答进行手动主题编码并达成一致以提高可靠性。
• 应用混合方法分析以在问题与主题之间实现 triangulation。

Figure 1. Satisfaction with security tools for npm packages.

实验结果

研究问题

• RQ1 RQ1: npm 开发者如何看待其包的安全性？
• RQ2 RQ2: npm 开发者在构建和维护包时使用了哪些安全实践与工具？
• RQ3 RQ3: 存在哪些障碍妨碍安全开发和维护 npm 包？
• RQ4 RQ4: 应优先改进哪些方面以加强 npm 包的安全性？

主要发现

• 开发者认为安全重要，但大多数将自己的包评为“有一定程度的安全性”。
• 供应链攻击和依赖性漏洞是被认为对 npm 生态系统的最大威胁。
• 只有40%的受访者对当前的 npm 安全工具感到满意，存在告警疲劳、可用性差和工具认知有限等问题。
• 自动化做法（如双因素认证、自动漏洞扫描）被广泛采用，而以人为中心的审查和培训较少。
• 依赖性卫生决策显示因被放弃或未修补的漏洞而停止使用某些依赖，指出维护和治理方面的挑战。