一句话：实证研究 NPM 项目中哪些依赖实际进入生产环境，并评估其安全风险。
现代软件系统常通过复用第三方库和包来加速开发，但项目因此依赖大量软件包。开发者需保持这些依赖更新并避免安全漏洞，维护负担沉重。然而，项目依赖中究竟有多少会在生产环境中被实际使用，从而可能对项目安全构成威胁，仍缺乏系统认识。本文对 NPM 生态系统中的生产依赖开展实证研究，提出并回答“并非所有依赖都等同”这一问题，区分生产依赖与非生产依赖，考察其在实际生产环境中的使用情况及安全含义。研究有助于开发者理解依赖维护的优先级，为依赖管理与漏洞治理提供经验依据。
Modern software systems are often built by leveraging code written by others in the form of libraries and packages to accelerate their development. While there are many benefits to using third-party packages, software projects often become dependent on a large number of software packages. Consequently, developers are faced with the difficult challenge of maintaining their project dependencies by keeping them up-to-date and free of security vulnerabilities. However, how often are project dependencies used in production where they could pose a threat to their project’s security?
@inproceedings{paperbot7241,
title = {Not All Dependencies are Equal: An Empirical Study on Production Dependencies in NPM},
author = {Jasmine Latendresse and Suhaib Mujahid and Diego Elias Costa and Emad Shihab},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3556896}
}