Pith. sign in

REVIEW 1 major objections 4 minor 2 cited by

Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks

T0 review · 1 major / 4 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Pinning direct dependencies to exact versions does not shrink the attack surface for malicious npm updates and, in projects with more than about 498 dependencies, actually enlarges it, because npm's deduplication logic installs extra…

desk verdict The novelty is real and the study is well-built, but the headline reversal depends on pinning to the minimal version in a range, not to the current version that real pinning uses. read the letter →

arxiv 2502.06662 v1 pith:6RZHJD7D submitted 2025-02-10 cs.SE cs.CR

Hao He , Bogdan Vasilescu , Christian Kästner This is my paper · ORCID
classification cs.SEcs.CR
keywords softwaresupplychainsecuritydependencypinningnpmecosystemmaliciouspackageupdatescounterfactualsimulationresolutionfixed-effectspanelregressionversionconstraints
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to settle, with quantitative evidence, whether pinning direct dependency versions protects npm projects from malicious package updates. It simulates what would happen if every project pinned all direct dependencies, resolving historical dependency graphs with npm's own resolver, and compares five security and maintenance metrics against the observed floating-practice baseline. The central finding is that pinning cuts the attack surface only for small graphs; beyond roughly 498 direct and transitive dependencies the effect reverses, because npm's deduplication logic installs more duplicate versions when constraints are rigid, and each duplicate branch can re-float transitive dependencies. A reader should care because pinning is currently promoted as a top security best practice, and this evidence suggests it can be counterproductive for large applications while still imposing real maintenance costs.

What carries the argument

The engine of the argument is npm's dependency resolution and deduplication behavior, combined with a time-traveling counterfactual: the authors use npm's undocumented --before flag to resolve each project's package.json as of five historical dates, in both its original (floating) form and a modified form where every direct constraint is pinned to the minimal version named. The five outcome metrics—floating edges, automatic updates, known vulnerabilities, outdated direct dependencies, and duplicate-version bloat—are then modeled with fixed-effects panel regression, with a pinning × ln(size(G)) interaction term that lets the attack-surface effect flip sign as graphs grow. The mechanism that produces the surprise is documented npm behavior: when multiple nodes constrain the same dependency and pinning prevents a shared version from satisfying all constraints, npm installs several versions, and the resulting extra branches re-introduce floating transitive edges.

What would settle it

Resolve the same 20,000 projects with pinning to the exact version that npm actually installed at each historical time point (i.e., lockfile-style pinning instead of minimal-version pinning) and compare the crossover point: if the number of floating dependencies no longer exceeds the control condition in large graphs, the paper's central reversal is an artifact of the counterfactual's minimal-version choice.

Watch

Extended reading notes

Core claim

By counterfactual simulation of 20,000 npm projects at five historical time points, the paper shows that pinning all direct dependencies (removing carets and tildes) increases the number of floating dependency edges in the resolved graph once the graph exceeds about 498 nodes. The driver is npm's dependency conflict resolution: rigid constraints defeat deduplication, so npm installs multiple versions of the same package, and each extra version branch typically carries floating transitive constraints of its own. Pinning reliably increases exposure to known vulnerabilities, outdated dependencies, and version bloat; its only expected benefit—fewer automatic updates—has weak explanatory power in the models. The paper further argues, through ecosystem-level simulation, that local pinning by individual projects is the wrong scale of intervention: pinning 100 intentionally selected core packages with transitive pinning reduces average malicious-update impact by up to about 76%, roughly two to three times more than the best local-pinning strategy.

Load-bearing premise

The simulated pinning treats "pinning" as removing carets and tildes and locking each direct dependency to the lowest version the original constraint allowed, rather than to the currently installed or audited version; if real-world pinning records newer versions, fewer duplicate versions would be installed and the reported crossover at about 498 dependencies could shrink or vanish.

Editorial extensions

If this is right

  • Pinning direct dependencies is not a dependable defense against malicious package updates in npm: once a project's resolved graph exceeds roughly 498 nodes, pinning increases, rather than decreases, the number of floating dependency edges an attacker could ride.
  • Pinning carries consistent maintenance costs—more known-vulnerable packages, more outdated direct dependencies, and more duplicate-version bloat—and these costs grow with dependency graph size.
  • Security scoring systems that treat pinned dependencies as a best practice should be re-examined, because a pinned package with a large graph can be more exposed to malicious updates than a floating one.
  • For applications, committing a lock file freezes the entire transitive graph and is a more direct way to stop automatic updates than pinning direct constraints.
  • Coordinated defense is measurably stronger than individual pinning: pinning and promptly reviewing 100 deliberately chosen upstream packages cuts simulated ecosystem-wide malicious-update impact by roughly 30% with local pinning and by up to about 76% if npm added transitive pinning.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If npm adopted transitive pinning by publishing package-lock.json for downstream resolution, the gains would concentrate in the most-connected packages, but the burden of auditing every transitive update would fall on a small set of maintainers whose review speed the paper optimistically assumes is immediate.
  • The 498-node crossover is a property of npm's multi-version resolver; in ecosystems with single-version resolution, pinning would not show this reversal, but the broader lesson that local pinning is a weak lever against malicious updates likely still holds because transitive constraints dominate the graph.
  • A direct test of the paper's counterfactual: pin each direct dependency to the currently installed version instead of the minimal version named in the range, and check whether the crossover vanishes; if it does, the practical advice shifts from 'do not pin' to 'pin to audited, current versions and keep them current.'
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

1 major / 4 minor

Summary. The paper investigates the security and maintenance impact of pinning direct dependencies in the npm ecosystem. For RQ1, the authors perform a counterfactual analysis by taking each project's package.json and treating an all-pinned variant as the treatment, resolving both original and treated dependency graphs at five historical time points using npm's time-traveling resolver, and then fitting fixed-effects panel regressions on five outcome metrics (floating dependencies, automatic updates, vulnerabilities, outdated dependencies, and bloated dependencies). They report that pinning increases maintenance costs (vulnerabilities, outdated dependencies, bloat) and, counter-intuitively, increases the number of floating dependencies for graphs larger than about 498 nodes, which they interpret as an increased attack surface for malicious updates. For RQ2, they simulate coordinated local and transitive pinning of selected upstream packages in the full npm dependency network and report that transitive pinning can reduce ecosystem-wide risk by up to 75% while local pinning achieves roughly 30%.

Significance. If the main RQ1 result is valid, it would provide quantitative evidence against a widely promoted security best practice and would be an important contribution to the pinning-versus-floating debate. The study is methodologically careful in many respects: it uses the actual npm resolver with time-traveling resolution, a large dataset of npm packages and GitHub repositories, fixed-effects panel regressions with project and time effects, robustness checks across subsamples, and a public replication package. The RQ2 analysis is clearly framed as an exploratory first step and offers a concrete, actionable direction for ecosystem-level interventions. The key limitation is that the surprising 'pinning backfires' result rests on a particular operationalization of pinning that may not reflect real pinning practice, so the central claim is not yet fully established.

major comments (1)
  1. [Section 3.2, Simulation Setup and Section 3.3, Figure 4] The treatment condition is implemented by removing carets and tildes, thereby pinning each direct dependency to the minimal version named in the original floating constraint. This is not how pinning is normally performed in npm: `npm install --save-exact` and manual pinning record the currently used or audited version, which is typically the highest version satisfying the range at installation time. Pinning to a lower bound systematically makes transitive floating ranges unsatisfiable and forces npm to install additional duplicate versions, which then create extra floating edges through the mechanism described in Section 5.1 and Figure 7. The crossover point at 498 nodes (Figure 4) and the positive pinning-by-size interaction in Table 4 are therefore likely to be highly sensitive to this modeling choice. To support the headline claim, the authors should rerun the analysis pinning each direct dependency to the latest version satisfying its range at each observation time (or to the version recorded in package-lock.json where available) and report whether the direction and significance of the interaction, and the crossover, persist. This is load-bearing because the 'pinning is futile and even harmful' conclusion, and the practical recommendations in Section 5.2, depend directly on this result.
minor comments (4)
  1. [Section 3.2, Simulation Setup] The paper should explicitly state in the Limitations and Threats to Validity subsection that the simulation pins to the minimal version of the original floating range, and that this is a conservative or worst-case interpretation of pinning that may not match common practitioner behavior.
  2. [Section 3.3, Table 4] The model for n_auto_updates has an adjusted R-squared of -0.052, effectively indicating no explanatory power. The paper acknowledges this, but the claim in the abstract that pinning has costs would be slightly clearer if the n_auto_updates result were described as inconclusive rather than as evidence that pinning reduces automatic updates.
  3. [Section 3.3, Figure 4] The x-axis of Figure 4 appears to use a logarithmic scale (the labeled ticks 54, 403, 2980 are roughly evenly spaced), but the caption does not state this; please add the scale information to the caption.
  4. [Section 5.2, Implication for Practitioners] The statistic that 44.21% of GitHub repositories commit package-lock.json is reported only for GitHub repositories; since the recommendation to use lock files is also directed at npm packages (which are components, not applications), the authors should clarify whether the statistic applies only to the application subset or also report the corresponding number for npm packages.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the counterfactual simulation and panel regression estimate effects from resolved dependency graphs, and the crossover threshold is a fitted consequence of the data, not an input assumption.

full rationale

The paper's central RQ1 claim is derived from a counterfactual simulation: the control condition resolves the original package.json files, and the treatment condition rewrites direct dependency constraints by removing carets and tildes, then both are resolved with npm's time-traveling resolver. The five outcome metrics (n_floating, n_auto_updates, n_vuln, n_outdated_deps, n_bloated) are computed directly from the resolved graphs. The fixed-effects panel regression then estimates the pinning coefficient, the size coefficient, and their interaction. The surprising crossover at 498 nodes (Figure 4) is a consequence of the fitted interaction term and the observed distribution of dependency graph sizes; it is not a parameter that was set in advance or an identity that holds by construction. The treatment operationalization—pinning to the minimal version in a floating range—is a modeling choice that may threaten construct validity if real-world pinning normally records the currently used version, but that is a correctness or external-validity concern, not circularity: the predicted outcome is not definitionally equal to the treatment input. RQ2 similarly computes risk from network reachability and download weights, and the defense heuristics are evaluated by simulation rather than fitted to force a conclusion. The paper cites prior work for datasets and tooling (e.g., npm-follower, the --before time-travel hack), but these are external sources with independent provenance, and no load-bearing claim reduces to a self-citation. Overall, the derivation chain is self-contained empirical inference, and no circular step is present.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claims rest on several explicitly stated modeling assumptions rather than hidden free parameters. No invented entities are introduced. The main vulnerability is the simulation of pinning via minimal versions and the uniform-random attack and breaking-change assumptions, both acknowledged but not stress-tested in the headline numbers.

free parameters (2)
  • n (number of defended packages) = 100
    Hand-selected scenario size for RQ2 headline results; the paper reports robustness across variations, but the 30% and 75% reductions are specific to n=100.
  • m (size of attacker target set) = 1000
    Hand-selected number of most impactful packages the attacker may choose from in RQ2; risk(A) is averaged over this set.
assumptions (5)
  • domain assumption npm's undocumented --before flag accurately reconstructs historical dependency resolution states.
    Section 3.2 Simulation Setup relies on this for both control and treatment graphs; 13-16% of resolutions fail and are discarded, which could bias the panel.
  • domain assumption Malicious package updates and breaking changes are uniformly randomly distributed.
    Section 3.2 Limitations and Section 4.1; used to interpret floating-edge counts and automatic-update counts as expected risk rather than actual events.
  • domain assumption Developers take no manual update actions after pinning during the simulated year.
    Section 3.2 Limitations; the paper labels this the conservative case, but real pinners can update promptly, changing vulnerability and outdatedness costs.
  • domain assumption Download-weighted reachability through floating edges is a valid measure of malicious-update impact.
    Section 4.1 Equation 2; equates download coverage with harm and ignores lock-file adoption and exploitability.
  • domain assumption The latest-version snapshot dependency network approximates true reverse dependencies.
    Section 4.1 Limitations; npm deduplication makes exact reverse dependencies infeasible, so the network is an approximation.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks." pith.science (2026). https://pith.science/paper/6RZHJD7D

@misc{pith2026250206662,
  author       = {Pith},
  title        = {Pith review of: Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6RZHJD7D}},
  note         = {Machine review of arXiv:2502.06662}
}
read the original abstract

Recent high-profile incidents in open-source software have greatly raised practitioner attention on software supply chain attacks. To guard against potential malicious package updates, security practitioners advocate pinning dependency to specific versions rather than floating in version ranges. However, it remains controversial whether pinning carries a meaningful security benefit that outweighs the cost of maintaining outdated and possibly vulnerable dependencies. In this paper, we quantify, through counterfactual analysis and simulations, the security and maintenance impact of version constraints in the npm ecosystem. By simulating dependency resolutions over historical time points, we find that pinning direct dependencies not only (as expected) increases the cost of maintaining vulnerable and outdated dependencies, but also (surprisingly) even increases the risk of exposure to malicious package updates in larger dependency graphs due to the specifics of npm's dependency resolution mechanism. Finally, we explore collective pinning strategies to secure the ecosystem against supply chain attacks, suggesting specific changes to npm to enable such interventions. Our study provides guidance for practitioners and tool designers to manage their supply chains more securely.

Figures

Figures reproduced from arXiv: 2502.06662 by the authors.

Figure 1
Figure 1. The distribution of version constraint types and project-level versioning strategies in each year in the [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. An example package.json file. We modified version constraints in the original file to illustrate different types of version constraints defined in Section 3.2. Other details irrelevant to this paper are omitted. Proc. ACM Softw. Eng., Vol. 2, No. FSE, Article FSE013. Publication date: July 2025 [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. An illustration of the trade-off be￾tween cost and risk after pinning. Our simulation setup enables a holistic approach to measure the costs of taking action (or the risks of not), but does not fully take into account the complexity of project actions that may happen over a year. For example, a project that opts for pinning can invest no effort in updating its pinned dependencies, rapidly update upon every new relea… view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: The effect of pinning direct dependencies on malicious package update attack surface (as measured by [PITH_FULL_IMAGE:figures/full_fig_p013_4.png]
Figure 5
Figure 5. Figure 5: Examples to illustrate attack impact computation and how local/transitive pinning works. [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: The reduction of malicious package update risk ( [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: A minimal example illustrating how pinning direct dependencies can cause dependency conflicts and [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. CHRONO-RESOLUTION: A Dependency Resolution Dataset at Release Points for npm, PyPI, and crates.io Packages

    cs.SE 2026-07 conditional novelty 6.0 of 10

    CHRONO-RESOLUTION provides per-release resolved dependency versions and OSV vulnerability annotations for active npm, PyPI, and crates.io packages.

  2. Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?

    cs.SE 2025-10 conditional novelty 5.0 of 10

    Across three package ecosystems, floating version constraints are less likely than pinning to leave dependencies outdated, while the claim that floating-minor is least vulnerability-prone is the main genuinely empiric...

Reference graph

Works this paper leans on

92 extracted references · 55 canonical work pages · cited by 2 Pith papers

  1. [2]

    IEEE Computer Society, 109–118. https://doi.org/10.1109/ICSE.2015.140 Yves Croissant, Giovanni Millo, Kevin Tappe, Ott Toomet, Christian Kleiber, Achim Zeileis, Arne Henningsen, Liviu Andronic, and Nina Schoenfelder

    doi:10.1109/icse.2015.140 2015

  2. [4]

    https://doi.org/10.1109/MSR52588.2021.00037 Chris Bogart, Christian Kästner, James D

    IEEE, 254–265. https://doi.org/10.1109/MSR52588.2021.00037 Chris Bogart, Christian Kästner, James D. Herbsleb, and Ferdian Thung

    arXiv 2021

  3. [5]

    ACM Trans

    When and How to Make Breaking Changes: Policies and Practices in 18 Open Source Software Ecosystems. ACM Trans. Softw. Eng. Methodol. 30, 4 (2021), 42:1–42:56. https://doi.org/10.1145/3447245 Josh Bressers

    doi:10.1145/3447245 2021

  4. [9]

    Lags in the release, adoption, and propagation of npm vulnerability fixes. Empir. Softw. Eng. 26, 3 (2021),

    2021

  5. [11]

    In 37th IEEE/ACM International Conference on Software Engineering, ICSE 2015, Florence, Italy, May 16-24, 2015, Volume

    Measuring Dependency Freshness in Software Systems. In 37th IEEE/ACM International Conference on Software Engineering, ICSE 2015, Florence, Italy, May 16-24, 2015, Volume

    2015

  6. [15]

    Retrieved December 11, 2023 from https://crashoverride.com/blog/dependency-pinning-only-works-if-you-actually-review-the-updates Erik DeBill

    Dependency Pinning Only Works If You Actually Review the Updates . Retrieved December 11, 2023 from https://crashoverride.com/blog/dependency-pinning-only-works-if-you-actually-review-the-updates Erik DeBill

    2023

  7. [16]

    Retrieved May 23, 2024 from http://www.modulecounts.com/ Alexandre Decan and Tom Mens

    Modulecounts. Retrieved May 23, 2024 from http://www.modulecounts.com/ Alexandre Decan and Tom Mens

    2024

  8. [17]

    Software Eng

    What Do Package Dependencies Tell Us About Semantic Versioning? IEEE Trans. Software Eng. 47, 6 (2021), 1226–1240. https://doi.org/10.1109/TSE.2019.2918315 Alexandre Decan, Tom Mens, and Eleni Constantinou

    arXiv 2021

Show all 92 references
  1. [20]

    In Proceedings of the 16th International Conference on Mining Software Repositories, MSR 2019, 26-27 May 2019, Montreal, Canada

    Dependency versioning in the wild. In Proceedings of the 16th International Conference on Mining Software Repositories, MSR 2019, 26-27 May 2019, Montreal, Canada. IEEE / ACM, 349–359. https://doi.org/10.1109/MSR.2019.00061 Nadia Eghbal

    2019

  2. [22]

    Good Practices for Supply Chain Cybersecurity . Retrieved August 27, 2024 from https://www.enisa.europa.eu/ publications/good-practices-for-supply-chain-cybersecurity Gang Fan, Chengpeng Wang, Rongxin Wu, Xiao Xiao, Qingkai Shi, and Charles Zhang

    2024

  3. [23]

    In ISSTA ’20: 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, USA, July 18-22, 2020

    Escaping dependency hell: finding build dependency errors with the unified dependency graph. In ISSTA ’20: 29th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, USA, July 18-22, 2020 . ACM, 463–474. https://doi.org/10. 1145/3395363.3397388 D...

    2020

  4. [24]

    login Usenix Mag

    For Good Measure: Counting Broken Links: A Quant’s View of Software Supply Chain Security. login Usenix Mag. 45, 4 (2020). https://www.usenix.org/publications/login/winter2020/geer Denis Gerstorf, Nilam Ram, Guy Mayraz, Mira Hidajat, Ulman Lindenberger, Gert G Wagner, and Jürg...

    2020

  5. [27]

    Retrieved April 21, 2024 from https://github.com/advisories Google

    GitHub Advisory Database. Retrieved April 21, 2024 from https://github.com/advisories Google

    2024

  6. [28]

    Retrieved September 8, 2024 from https://cloud.google.com/security/products/ assured-open-source-software Hacker News

    Assured Open Source Software . Retrieved September 8, 2024 from https://cloud.google.com/security/products/ assured-open-source-software Hacker News

    2024

  7. [29]

    Retrieved December 11, 2023 from https://news.ycombinator.com/item?id=14759329 Hacker News

    Package Management: The problem with using version ranges . Retrieved December 11, 2023 from https://news.ycombinator.com/item?id=14759329 Hacker News

    2023

  8. [30]

    Retrieved December 13, 2023 from https://news

    I have misgivings about all these version pinning... Retrieved December 13, 2023 from https://news. ycombinator.com/item?id=16422916 Christoph Hanck, Martin Arnold, Alexander Gerber, and Martin Schmelzer

    2023

  9. [31]

    In ESEC/FSE ’21: 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece, August 23-28, 2021

    A large-scale empirical study on Java library migrations: prevalence, trends, and rationales. In ESEC/FSE ’21: 29th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Athens, Greece, August 23-28, 2021 . ACM, 478–490. h...

    2021

  10. [32]

    IEEE Trans

    Automating Dependency Updates in Practice: An Exploratory Study on GitHub Dependabot. IEEE Trans. Software Eng. 49, 8 (2023), 4004–4022. https://doi.org/10.1109/TSE.2023.3278129 IBM

    2023

  11. [33]

    What is the Log4j vulnerability? Retrieved December 10, 2023 from https://www.ibm.com/topics/log4j Jay Jacobs, Sasha Romanosky, Benjamin Edwards, Michael Roytman, and Idris Adjerid

    2023

  12. [34]

    CoRR abs/1908.04856 (2019)

    Exploit Prediction Scoring System (EPSS). CoRR abs/1908.04856 (2019). arXiv:1908.04856 http://arxiv.org/abs/1908.04856 Abbas Javan Jafari, Diego Elias Costa, Rabe Abdalkareem, Emad Shihab, and Nikolaos Tsantalis

    2019 arXiv

  13. [35]

    IEEE Trans

    Dependency Smells in JavaScript Projects. IEEE Trans. Software Eng. 48, 10 (2022), 3790–3807. https://doi.org/10.1109/TSE.2021.3106247 Abbas Javan Jafari, Diego Elias Costa, Emad Shihab, and Rabe Abdalkareem

    2022

  14. [36]

    ACM Trans

    Dependency Update Strategies and Package Characteristics. ACM Trans. Softw. Eng. Methodol. 32, 6 (2023), 149:1–149:29. https://doi.org/10.1145/3603110 Dhanushka Jayasuriya, Valerio Terragni, Jens Dietrich, Samuel Ou, and Kelly Blincoe

    2023 doi

  15. [37]

    In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2023, Seattle, W A, USA, July 17-21,

    Understanding Breaking Changes in the Wild. In Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2023, Seattle, W A, USA, July 17-21,

    2023

  16. [38]

    https://doi.org/10.1145/3597926.3598147 Dezhen Kong, Jiakun Liu, Lingfeng Bao, and David Lo

    ACM, 1433–1444. https://doi.org/10.1145/3597926.3598147 Dezhen Kong, Jiakun Liu, Lingfeng Bao, and David Lo

  17. [39]

    arXiv preprint arXiv:2408.14431 (2024)

    Towards Better Comprehension of Breaking Changes in the NPM Ecosystem. arXiv preprint arXiv:2408.14431 (2024). https://arxiv.org/pdf/2408.14431 Raula Gaikovina Kula, Daniel M. Germán, Ali Ouni, Takashi Ishio, and Katsuro Inoue

    2024 arXiv

  18. [40]

    Do developers update their library dependencies? - An empirical study on the impact of security advisories on library migration. Empir. Softw. Eng. 23, 1 (2018), 384–417. https://doi.org/10.1007/S10664-017-9521-5 Piergiorgio Ladisa, Henrik Plate, Matias Martinez, and Olivier Barais

    2018 doi

  19. [41]

    In 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, Proc

    SoK: Taxonomy of Attacks on Open-Source Software Supply Chains. In 44th IEEE Symposium on Security and Privacy, SP 2023, San Francisco, CA, USA, May 21-25, Proc. ACM Softw. Eng., Vol. 2, No. FSE, Article FSE013. Publication date: July

    2023

  20. [42]

    https://doi.org/10.1109/SP46215.2023.10179304 Jasmine Latendresse, Suhaib Mujahid, Diego Elias Costa, and Emad Shihab

    IEEE, 1509–1526. https://doi.org/10.1109/SP46215.2023.10179304 Jasmine Latendresse, Suhaib Mujahid, Diego Elias Costa, and Emad Shihab

    2023

  21. [43]

    In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022

    Not All Dependencies are Equal: An Empirical Study on Production Dependencies in NPM. In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022 . ACM, 73:1–73:12. https://doi.org/10.1145/3551349.3556896 Max Leiter

    2022

  22. [44]

    Retrieved December 13, 2023 from https://maxleiter.com/blog/pin- dependencies Chengwei Liu, Sen Chen, Lingling Fan, Bihuan Chen, Yang Liu, and Xin Peng

    Pin your npm/yarn dependencies . Retrieved December 13, 2023 from https://maxleiter.com/blog/pin- dependencies Chengwei Liu, Sen Chen, Lingling Fan, Bihuan Chen, Yang Liu, and Xin Peng

    2023

  23. [46]

    Retrieved December 13, 2023 from https://www.lucidchart

    Package Management: Stop Using Version Ranges . Retrieved December 13, 2023 from https://www.lucidchart. com/techblog/2017/03/15/package-management-stop-using-version-ranges/ Yuxing Ma, Tapajit Dey, Chris Bogart, Sadika Amreen, Marat Valiev, Adam Tutko, David Kennard, Russell ...

    2023

  24. [47]

    https: //doi.org/10.1007/S10664-021-09951-X Joel Cox, Eric Bouwers, Marko C. J. D. van Eekelen, and Joost Visser

    doi

  25. [48]

    World of code: enabling a research workflow for mining and analyzing the universe of open source VCS data. Empir. Softw. Eng. 26, 2 (2021),

    2021

  26. [49]

    https://doi.org/10.1007/S10664-020-09905-9 Fabio Mancinelli, Jaap Boender, Roberto Di Cosmo, Jerome Vouillon, Berke Durak, Xavier Leroy, and Ralf Treinen

    doi

  27. [50]

    International Journal of Safety and Security Engineering 11, 5 (2021), 537–545

    Software supply chain attacks, a threat to global cybersecurity: SolarWinds’ case study. International Journal of Safety and Security Engineering 11, 5 (2021), 537–545. https://doi.org/10.18280/ijsse.110505 Gianluca Mezzetti, Anders Møller, and Martin Toldam Torp

    2021 doi

  28. [51]

    In 32nd European Conference on Object-Oriented Programming, ECOOP 2018, July 16-21, 2018, Amsterdam, The Netherlands (LIPIcs, Vol

    Type Regression Testing to Detect Breaking Changes in Node.js Libraries. In 32nd European Conference on Object-Oriented Programming, ECOOP 2018, July 16-21, 2018, Amsterdam, The Netherlands (LIPIcs, Vol

    2018

  29. [53]

    We Feel Like We’re Winging It:

    "We Feel Like We’re Winging It: " A Study on Navigating Open-Source Dependency Abandonment. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC/FSE 2023, San Francisco, CA, USA, December 3...

    2023

  30. [54]

    In Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering, ASE 2017, Urbana, IL, USA, October 30 - November 03, 2017

    Can automated pull requests encourage software developers to upgrade out-of- date dependencies?. In Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering, ASE 2017, Urbana, IL, USA, October 30 - November 03, 2017 . IEEE Computer Society, 8...

    2017

  31. [55]

    In ISSTA ’21: 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, Denmark, July 11-17, 2021 , Cristian Cadar and Xiangyu Zhang (Eds.)

    Fixing dependency errors for Python build reproducibility. In ISSTA ’21: 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, Virtual Event, Denmark, July 11-17, 2021 , Cristian Cadar and Xiangyu Zhang (Eds.). ACM, 439–451. https://doi.org/10.1145/3460319...

    2021 doi

  32. [56]

    Backstabber’s Knife Collection: A Review of Open Source Software Supply Chain Attacks. In Detection of Intrusions and Malware, and Vulnerability Assessment - 17th International Conference, DIMV A 2020, Lisbon, Portugal, June 24-26, 2020, Proceedings (Lecture Notes in Computer ...

    2020 doi

  33. [57]

    OpenSSF Scorecard. Retrieved December 11, 2023 from https://github.com/ossf/scorecard/blob/main/docs/ checks.md#pinned-dependencies Ivan Pashchenko, Henrik Plate, Serena Elisa Ponta, Antonino Sabetta, and Fabio Massacci

    2023

  34. [58]

    In Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, ESEM 2018, Oulu, Finland, October 11-12, 2018

    Vulnerable open source dependencies: counting those that matter. In Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, ESEM 2018, Oulu, Finland, October 11-12, 2018 . ACM, 42:1–42:10. https://doi.org/ 10.1145/3239235.326...

    2018

  35. [59]

    In CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13,

    A Qualitative Study of Dependency Management and Its Security Implications. In CCS ’20: 2020 ACM SIGSAC Conference on Computer and Communications Security, Virtual Event, USA, November 9-13,

    2020

  36. [60]

    https://doi.org/10.1145/3372297.3417232 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell

    ACM, 1513–1531. https://doi.org/10.1145/3372297.3417232 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell. 2023a. A Large Scale Analysis of Semantic Versioning in NPM. In 20th IEEE/ACM International Conference on Mining Software Repositories, MSR 2023, Melbourne...

  37. [61]

    https://doi.org/10.1109/MSR59073.2023.00073 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell

    IEEE, 485–497. https://doi.org/10.1109/MSR59073.2023.00073 Donald Pinckney, Federico Cassano, Arjun Guha, and Jonathan Bell. 2023b. npm-follower: A Complete Dataset Tracking the NPM Ecosystem. In Proceedings of the 31st ACM Joint European Software Engineering Conference and Sy...

    2023

  38. [62]

    Retrieved December 11, 2023 from https://semver.org/ Maciej Radzikowski

    Semantic versioning 2.0.0. Retrieved December 11, 2023 from https://semver.org/ Maciej Radzikowski

    2023

  39. [63]

    Retrieved December 13, 2023 from https://betterdev.blog/pin- exact-dependency-versions/ Steven Raemaekers, Arie van Deursen, and Joost Visser

    Pin exact dependency versions . Retrieved December 13, 2023 from https://betterdev.blog/pin- exact-dependency-versions/ Steven Raemaekers, Arie van Deursen, and Joost Visser

    2023

  40. [64]

    Semantic versioning and impact of breaking changes in the Maven repository. J. Syst. Softw. 129 (2017), 140–158. https://doi.org/10.1016/J.JSS.2016.04.008 Matt Raible

    2017 doi

  41. [65]

    Retrieved May 23, 2024 from https://developer

    Semantic Versioning Sucks! Long Live Semantic Versioning . Retrieved May 23, 2024 from https://developer. okta.com/blog/2019/12/16/semantic-versioning Renovate Bot

    2024

  42. [66]

    com/dependency-pinning Edgar H Schein

    Should you pin your JavaScript dependencies? Retrieved December 11, 2023 from https://docs.renovatebot. com/dependency-pinning Edgar H Schein

    2023

  43. [67]

    Collective Intelligence 3, 1 (2024), 26339137241231912

    Modeling interconnected social and technical risks in open source software ecosystems. Collective Intelligence 3, 1 (2024), 26339137241231912. Adriana Sejfia and Max Schäfer

    2024

  44. [68]

    In 44th IEEE/ACM 44th International Conference on Software Engineering, ICSE 2022, Pittsburgh, PA, USA, May 25-27, 2022

    Practical Automated Detection of Malicious npm Packages. In 44th IEEE/ACM 44th International Conference on Software Engineering, ICSE 2022, Pittsburgh, PA, USA, May 25-27, 2022 . ACM, 1681–1692. https://doi.org/10.1145/3510003.3510104 Arielle S Selya, Jennifer S Rose, Lisa C D...

    2022

  45. [72]

    Retrieved Augest 22, 2023 from https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ Sonatype

    Alert: peacenotwar module sabotages npm developers in the node-ipc package to protest the invasion of Ukraine . Retrieved Augest 22, 2023 from https://snyk.io/blog/peacenotwar-malicious-npm-node-ipc-package-vulnerability/ Sonatype

    2023

  46. [73]

    Retrieved May 24, 2024 from https://www.sonatype.com/ blog/software-supply-chain-a-definition-and-introductory-guide Sonatype

    Software supply chains: An introductory guide . Retrieved May 24, 2024 from https://www.sonatype.com/ blog/software-supply-chain-a-definition-and-introductory-guide Sonatype. 2024a. 10th Annual State of the Software Supply Chain. Retrieved Jan 16, 2025 from https://www.sonatyp...

    2024

  47. [75]

    com/questions/28509481/should-i-pin-my-python-dependencies-versions Alois Stutzer and Bruno S Frey

    Should I pin my Python dependencies versions? Retrieved December 13, 2023 from https://stackoverflow. com/questions/28509481/should-i-pin-my-python-dependencies-versions Alois Stutzer and Bruno S Frey

    2023

  48. [76]

    https://doi.org/doi.org/10.1016/j.socec.2005.11.043 TechTarget

    Does marriage make people happy, or do happy people get married? The Journal of Socio-Economics 35, 2 (2006), 326–347. https://doi.org/doi.org/10.1016/j.socec.2005.11.043 TechTarget

    2006 doi

  49. [77]

    Retrieved May 22, 2024 from https://www

    SolarWinds hack explained: Everything you need to know . Retrieved May 22, 2024 from https://www. techtarget.com/whatis/feature/SolarWinds-hack-explained-Everything-you-need-to-know The White House

    2024

  50. [78]

    Retrieved August 27, 2024 from https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the- nations-cybersecurity/ David A

    Executive Order on Improving the Nation’s Cybersecurity . Retrieved August 27, 2024 from https://www.whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the- nations-cybersecurity/ David A. Tomassi, Naji Dmeiri, Yichen Wang, Antara Bhowmic...

    2024

  51. [79]

    In Proceedings of the 41st International Conference on Software Engineering, ICSE 2019, Montreal, QC, Canada, May Proc

    BugSwarm: Mining and continuously growing a dataset of reproducible failures and fixes. In Proceedings of the 41st International Conference on Software Engineering, ICSE 2019, Montreal, QC, Canada, May Proc. ACM Softw. Eng., Vol. 2, No. FSE, Article FSE013. Publication date: July

    2019

  52. [80]

    https://doi.org/10.1109/ICSE.2019.00048 Marat Valiev, Bogdan Vasilescu, and James D

    IEEE / ACM, 339–349. https://doi.org/10.1109/ICSE.2019.00048 Marat Valiev, Bogdan Vasilescu, and James D. Herbsleb

    2019

  53. [82]

    In ESEC/FSE ’20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Virtual Event, USA, November 8-13, 2020

    Selecting third-party libraries: the practitioners’ perspective. In ESEC/FSE ’20: 28th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Virtual Event, USA, November 8-13, 2020 . ACM, 245–256. https://doi.org/10.1145/3...

    2020

  54. [83]

    In IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2020, Genoa, Italy, September 7-11, 2020

    Typosquatting and Combosquatting Attacks on the Python Ecosystem. In IEEE European Symposium on Security and Privacy Workshops, EuroS&P Workshops 2020, Genoa, Italy, September 7-11, 2020 . IEEE, 509–514. https://doi.org/10.1109/EUROSPW51379.2020.00074 James Walden

    2020

  55. [84]

    In MSR ’20: 17th International Conference on Mining Software Repositories, Seoul, Republic of Korea, 29-30 June, 2020

    The Impact of a Major Security Event on an Open Source Project: The Case of OpenSSL. In MSR ’20: 17th International Conference on Mining Software Repositories, Seoul, Republic of Korea, 29-30 June, 2020 . ACM, 409–419. https://doi.org/10.1145/3379597.3387465 Ying Wang, Peng Su...

    2020

  56. [85]

    IEEE Trans

    Plumber: Boosting the Propagation of Vulnerability Fixes in the npm Ecosystem. IEEE Trans. Software Eng. 49, 5 (2023), 3155–3181. https://doi.org/10.1109/TSE.2023.3243262 Ying Wang, Ming Wen, Yepang Liu, Yibo Wang, Zhenming Li, Chao Wang, Hai Yu, Shing-Chi Cheung, Chang Xu, an...

    2023

  57. [86]

    In ICSE ’20: 42nd International Conference on Software Engineering, Seoul, South Korea, 27 June - 19 July, 2020

    Watchman: monitoring dependency conflicts for Python library ecosystem. In ICSE ’20: 42nd International Conference on Software Engineering, Seoul, South Korea, 27 June - 19 July, 2020 . ACM, 125–135. https: //doi.org/10.1145/3377811.3380426 Ying Wang, Ming Wen, Zhenwei Liu, Ro...

    2020

  58. [87]

    Do the dependency conflicts in my project matter?. In Proceedings of the 2018 ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, ESEC/SIGSOFT FSE 2018, Lake Buena Vista, FL, USA, November 04-09, 2018 . ACM, 3...

    2018

  59. [88]

    Retrieved May 23, 2024 from https://www.hyrumslaw.com/ Jiadong Xie, Fan Zhang, Kai Wang, Xuemin Lin, and Wenjie Zhang

    Hyrum’s Law. Retrieved May 23, 2024 from https://www.hyrumslaw.com/ Jiadong Xie, Fan Zhang, Kai Wang, Xuemin Lin, and Wenjie Zhang

    2024

  60. [89]

    In 39th IEEE International Conference on Data Engineering, ICDE 2023, Anaheim, CA, USA, April 3-7, 2023

    Minimizing the Influence of Misinformation via Vertex Blocking. In 39th IEEE International Conference on Data Engineering, ICDE 2023, Anaheim, CA, USA, April 3-7, 2023 . IEEE, 789–801. https://doi.org/10.1109/ICDE55515.2023.00066 Weiwei Xu, Hao He, Kai Gao, and Minghui Zhou

    2023

  61. [90]

    In 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023, Luxembourg, September 11-15, 2023

    Understanding and Remediating Open-Source License Incompatibil- ities in the PyPI Ecosystem. In 38th IEEE/ACM International Conference on Automated Software Engineering, ASE 2023, Luxembourg, September 11-15, 2023 . IEEE, 178–190. https://doi.org/10.1109/ASE56229.2023.00175 Aw...

    2023

  62. [91]

    In Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy, CODASPY 2016, New Orleans, LA, USA, March 9-11, 2016

    To Fear or Not to Fear That is the Question: Code Characteristics of a Vulnerable Functionwith an Existing Exploit. In Proceedings of the Sixth ACM on Conference on Data and Application Security and Privacy, CODASPY 2016, New Orleans, LA, USA, March 9-11, 2016 . ACM, 97–104. h...

    2016

  63. [92]

    CoRR abs/2403.12196 (2024)

    Shifting the Lens: Detecting Malware in npm Ecosystem with Large Language Models. CoRR abs/2403.12196 (2024). https://doi.org/10. 48550/ARXIV.2403.12196 arXiv:2403.12196 Nusrat Zahan, Parth Kanakiya, Brian Hambleton, Shohanuzzaman Shohan, and Laurie A. Williams. 2023a. OpenSSF...

    2024 doi arXiv

  64. [93]

    https://doi.org/10.1109/ICSE-SEIP58684.2023.00032 Lyuye Zhang, Chengwei Liu, Zhengzi Xu, Sen Chen, Lingling Fan, Bihuan Chen, and Yang Liu

    IEEE, 292–303. https://doi.org/10.1109/ICSE-SEIP58684.2023.00032 Lyuye Zhang, Chengwei Liu, Zhengzi Xu, Sen Chen, Lingling Fan, Bihuan Chen, and Yang Liu

    2023

  65. [94]

    In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022

    Has My Release Disobeyed Semantic Versioning? Static Detection Based on Semantic Differencing. In 37th IEEE/ACM International Conference on Automated Software Engineering, ASE 2022, Rochester, MI, USA, October 10-14, 2022 . ACM, 51:1–51:12. https://doi.org/10.1145/3551349.3556...

    2022

  66. [95]

    In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019

    Small World with High Risks: A Study of Security Threats in the npm Ecosystem. In 28th USENIX Security Symposium, USENIX Security 2019, Santa Clara, CA, USA, August 14-16, 2019 . USENIX Association, 995–1010. https://www.usenix.org/conference/usenixsecurity19/ presentation/zim...

    2019

  67. [109]

    https: //doi.org/10.4230/LIPICS.ECOOP.2018.7 Courtney Miller, Christian Kästner, and Bogdan Vasilescu

    Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 7:1–7:24. https: //doi.org/10.4230/LIPICS.ECOOP.2018.7 Courtney Miller, Christian Kästner, and Bogdan Vasilescu

    2018 doi

  68. [477]

    https://doi.org/doi.org/10.1037/a0017543 GitHub

    doi

  69. [1987]

    Science 236, 4799 (1987), 280–285

    Perception of risk. Science 236, 4799 (1987), 280–285. Snyk

    1987

  70. [1999]

    Archives of Internal Medicine 159, 17 (1999), 2070–2076

    A randomized trial comparing the effect of casein with that of soy protein containing varying amounts of isoflavones on plasma concentrations of lipids and lipoproteins. Archives of Internal Medicine 159, 17 (1999), 2070–2076. https://doi.org/10. 1001/archinte.159.17.2070 Proc...

    1999

  71. [2006]

    In 21st IEEE/ACM International Conference on Automated Software Engineering (ASE 2006), 18-22 September 2006, Tokyo, Japan

    Managing the Complexity of Large Free and Open Source Package-Based Software Distributions. In 21st IEEE/ACM International Conference on Automated Software Engineering (ASE 2006), 18-22 September 2006, Tokyo, Japan . IEEE Computer Society, 199–208. https://doi.org/10.1109/ASE....

    2006 doi

  72. [2010]

    Psychology and Aging 25, 2 (2010),

    Late-life decline in well-being across adulthood in Germany, the United Kingdom, and the United States: Something is seriously wrong at the end of life. Psychology and Aging 25, 2 (2010),

    2010

  73. [2012]

    Frontiers in Psychology 3 (2012),

    A practical guide to calculating Cohen’s𝑓 2, a measure of local effect size, from PROC MIXED. Frontiers in Psychology 3 (2012),

    2012

  74. [2014]

    In 36th International Conference on Software Engineering, ICSE ’14, Hyderabad, India - May 31 - June 07, 2014

    Programmers’ build errors: A case study (at Google). In 36th International Conference on Software Engineering, ICSE ’14, Hyderabad, India - May 31 - June 07, 2014 . ACM, 724–734. https://doi.org/10.1145/2568225.2568255 Paul Slovic

    2014

  75. [2015]

    The Sage Handbook of Regression Analysis and Causal Inference 327 (2015),

    Fixed-effects panel regression. The Sage Handbook of Regression Analysis and Causal Inference 327 (2015),

    2015

  76. [2016]

    The Unseen Labor Behind our Digital Infrastructure (2016)

    Roads and Bridges. The Unseen Labor Behind our Digital Infrastructure (2016). ENISA

    2016

  77. [2017]

    In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2017, Paderborn, Germany, September 4-8, 2017

    Why do developers use trivial packages? An empirical case study on npm. In Proceedings of the 2017 11th Joint Meeting on Foundations of Software Engineering, ESEC/FSE 2017, Paderborn, Germany, September 4-8, 2017 . ACM, 385–395. https://doi.org/10.1145/3106237. 3106267 Mahmoud...

    2017 doi

  78. [2018]

    In Proceedings of the 15th International Conference on Mining Software Repositories, MSR 2018, Gothenburg, Sweden, May 28-29, 2018

    On the impact of security vulnerabilities in the npm package dependency network. In Proceedings of the 15th International Conference on Mining Software Repositories, MSR 2018, Gothenburg, Sweden, May 28-29, 2018 . ACM, 181–191. https://doi.org/10.1145/3196398.3196401 Alexandre...

    2018

  79. [2019]

    An empirical comparison of dependency network evolution in seven software packaging ecosystems.Empir. Softw. Eng.24, 1 (2019), 381–416. https://doi.org/10.1007/S10664-017-9589-Y Jens Dietrich, David J. Pearce, Jacob Stringer, Amjed Tahir, and Kelly Blincoe

    2019 doi

  80. [2020]

    In 27th IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2020, London, ON, Canada, February 18-21, 2020

    Dependency Solving Is Still Hard, but We Are Getting Better at It. In 27th IEEE International Conference on Software Analysis, Evolution and Reengineering, SANER 2020, London, ON, Canada, February 18-21, 2020 . IEEE, 547–551. https://doi.org/10.1109/SANER48275.2020.9054837 Rab...

    2020

  81. [2021]

    In 18th IEEE/ACM International Conference on Mining Software Repositories, MSR 2021, Madrid, Spain, May 17-19,

    On the Use of Dependabot Security Pull Requests. In 18th IEEE/ACM International Conference on Mining Software Repositories, MSR 2021, Madrid, Spain, May 17-19,

    2021

  82. [2022]

    Feelings

    Fact vs. Feelings. Retrieved December 11, 2023 from https://opensourcesecurity.io/2022/03/21/facts-vs- feelings/ Josef Brüderl and Volker Ludwig

    2023

  83. [2023]

    NPM Account Takeover Results in Crypto Supply Chain Attack . Retrieved April 28, 2024 from https: //checkmarx.com/blog/npm-account-takeover-results-in-crypto-supply-chain-attack/ Bodin Chinthanet, Raula Gaikovina Kula, Shane McIntosh, Takashi Ishio, Akinori Ihara, and Kenichi ...

    2024

  84. [2024]

    Retrieved April 28, 2024 from https://cran.r- project.org/web/packages/plm John R Crouse, Timothy Morgan, James G Terry, Julie Ellis, Mara Vitolins, and Gregory L Burke

    plm: Linear Models for Panel Data . Retrieved April 28, 2024 from https://cran.r- project.org/web/packages/plm John R Crouse, Timothy Morgan, James G Terry, Julie Ellis, Mara Vitolins, and Gregory L Burke

    2024

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.