一句话：构建持续归档 NPM 所有包与版本的元数据和代码的数据集与爬取架构，可保留后续被删除的数据。
现代软件开发依赖庞大的依赖网络，NPM 仓库拥有超过 300 万个包和每周数百亿次下载。理解包、依赖与已发布代码需要便于访问元数据和代码的数据集。然而，已有 NPM 数据集工作通常只抓取元数据，且无法抓取从 NPM 删除的包或版本；2022 年 7 月至 2023 年 5 月间就有超过 33 万个版本被删除，这些数据对安全与恶意软件研究至关重要。本文提出 npm-follower：一个数据集与爬取架构，在包和版本发布时归档其元数据与代码，因此能够保留之后被删除的数据。该数据集目前包含超过 3500 万个包版本，每月约新增 100 万个版本，并便于研究者开展元数据或程序分析相关研究。代码与数据集见 https://dependencies.science。
Software developers typically rely upon a large network of dependencies to build their applications. For instance, the NPM package repository contains over 3 million packages and serves tens of billions of downloads weekly. Understanding the structure and nature of packages, dependencies, and published code requires datasets that provide researchers with easy access to metadata and code of packages. However, prior work on NPM dataset construction typically has two limitations: 1) only metadata is scraped, and 2) packages or versions that are deleted from NPM can not be scraped. Over 330,000 versions of packages were deleted from NPM between July 2022 and May 2023. This data is critical for researchers as it often pertains to important questions of security and malware. We present npm-follower, a dataset and crawling architecture which archives metadata and code of all packages and versions as they are published, and is thus able to retain data which is later deleted. The dataset currently includes over 35 million versions of packages, and grows at a rate of about 1 million versions per month. The dataset is designed to be easily used by researchers answering questions involving either metadata or program analysis. Both the code and dataset are available at: https://dependencies.science