一句话：大规模分析 npm 广泛使用包的弃养普遍性、暴露范围及项目响应，发现显式 EOL 能加速移除。
论文关注开源数字基础设施中广泛使用包被停止维护（弃养）后的实际影响与应对。作者对 npm 生态中所有广泛使用的包进行大规模定量分析，考察弃养的普遍程度、依赖方暴露情况、项目响应以及相关因素。结果显示：弃养在常用包中很常见；会暴露大量项目，而许多项目并不响应；响应行为与其他依赖管理实践相关；当包显式声明生命周期结束（end-of-life）状态时，依赖移除显著更快。最后向研究者和面临弃养或计划退役包的实践者提出建议，例如低成本透明机制可帮助暴露项目做出更明智决策。
Many developers relying on open-source digital infrastructure expect continuous maintenance, but even the most critical packages can become unmaintained. Despite this, there is little understanding of the prevalence of abandonment of widely-used packages, of subsequent exposure, and of reactions to abandonment in practice, or the factors that influence them. We perform a large-scale quantitative analysis of all widely-used npm packages and find that abandonment is common among them, that abandonment exposes many projects which often do not respond, that responses correlate with other dependency management practices, and that removal is significantly faster when a package's end-of-life status is explicitly stated. We end with recommendations to both researchers and practitioners who are facing dependency abandonment or are sunsetting packages, such as opportunities for low-effort transparency mechanisms to help exposed projects make better, more informed decisions.
DOI 原文 ·
@inproceedings{paperbot8765,
title = {Understanding the Response to Open-Source Dependency Abandonment in the npm Ecosystem},
author = {Courtney Miller and Mahmoud Jahanshahi and Audris Mockus and Bogdan Vasilescu and Christian Kastner},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00004}
}