一句话：首次研究 npm 中 peer dependency 冲突导致的解析死循环 PeerSpin，并提出检测工具 PeerChecker。
npm 支持特殊的 peer dependency，但其冲突可能使 npm 客户端在依赖解析中陷入无限循环，造成资源耗尽甚至系统崩溃，而此前研究尚未关注该问题。本文首次系统研究这一现象，并将其命名为 PeerSpin。作者分析 npm 依赖解析流程，定位根因，并归纳两种 peer dependency 模式以指导检测。基于依赖解析过程中的目录树状态，提出 Node-Replacement-Conflict 检测技术，实现工具 PeerChecker。作者在整个 npm 生态上评估，发现 5,662 个包、共 72,968 个版本受 PeerSpin 影响；已报告 100 个问题包并获得 28 个确认。所有分析实现、工具与数据集均已开源，以帮助社区检测 PeerSpin 并提升 npm 生态可靠性。
As the default package manager for Node.js, npm has become one of the largest package management systems in the world. To facilitate dependency management for developers, npm supports a special type of dependency, Peer Dependency, whose installation and usage differ from regular dependencies. However, conflicts between peer dependencies can trap the npm client into infinite loops, leading to resource exhaustion and system crashes. We name this problem PeerSpin. Although PeerSpin poses a severe risk to ecosystems, it was overlooked by previous studies, and its impacts have not been explored. To bridge this gap, this paper conducts the first in-depth study to understand and detect PeerSpin in the npm ecosystem. First, by systematically analyzing the npm dependency resolution, we identify the root cause of PeerSpin and characterize two peer dependency patterns to guide detection. Second, we propose a novel technique called Node-Replacement-Conflict based PeerSpin Detection, which leverages the state of the directory tree during dependency resolution to achieve accurate and efficient PeerSpin detection. Based on this technique, we developed a tool called PeerChecker to detect PeerSpin. Finally, we apply PeerChecker to the entire npm ecosystem and find that 5,662 packages, totaling 72,968 versions, suffer from PeerSpin. Until now, we have selected 100 problematic packages to report and received 28 confirmations. We also open source all PeerSpin analysis implementations, tools, and data sets to the public to help the community detect PeerSpin issues and enhance the reliability of the npm ecosystem.
DOI 原文 ·
@inproceedings{paperbot8902,
title = {Understanding and Detecting Peer Dependency Resolving Loop in npm Ecosystem},
author = {Xingyu Wang and Mingsen Wang and Wenbo Shen and Rui Chang},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00054}
}