2026-06-10T07:13:35Zhttps://riubu.ubu.es/oai/request

oai:riubu.ubu.es:10259/82132023-12-16T01:05:13Zcom_10259_5377com_10259_5086com_10259_2604com_10259_3830col_10259_5378col_10259_3832

Setó Rey, Daniel Santos Martín, José Ignacio López Nozal, Carlos 2023-11 Software reuse by importing packages from centralised repositories is an efficient and increasingly widespread way to develop software. Given the transitivity of dependencies, defects introduced in the repository can have extensive effects on the software ecosystem. Drawing from complex network theory, we define a model of repository vulnerability based on the statistically expected damage that the repository sustains from the random introduction of software defects. We test the model in stylized networks derived from real repositories, PyPI, Maven and npm, and show that the existence of a giant strongly connected component (SCC) explains most of the vulnerability. Indeed, we found that theoretical protection (immunization) of this entire component would remove almost all vulnerability from the network. Since repositories and their communities have limited resources to mitigate issues, we further model the problem of how to best apply these resources, finding sets much smaller than the giant SCC whose protection is nearly as good. Furthermore, we prove that the optimal selection of sets of given size is NP-hard but can be approached with heuristics, yielding respectable results. Our model contributes to a better understanding of software package repositories and could also be applied to other systems with a similar structure. application/pdf http://hdl.handle.net/10259/8213 eng Institute of Electrical and Electronics Engineers Vulnerability of Package Dependency Networks info:eu-repo/semantics/article TEXT RIUBU. Repositorio Institucional de la Universidad de Burgos Hispana