npm Vulnerability Propagation Study

A repository analyzing how security vulnerabilities propagate through the npm dependency graph.

Status

• Task 1: Baseline dataset setup
• Task 3: SemVer gate analysis (Flat Ecosystem Baseline)
• Task 4: Network Crawler, DAG Reduction & Empirical Depth Propagation Analysis
• Task 5: Empirical Survival & Repair-Time Modeling (Gamma Distribution)

Methodology & Dataset Scope

• Sample: Real npm advisories across well-known core packages (axios, express, ws, debug, braces, tar, semver, qs, minimatch, lodash, node-fetch, moment, minimist).
• Dependents Source: deps.dev internal dependents endpoint (deps.dev/_/s/npm/p/{package}/v/{version}/dependents).
• Classification Logic: Evaluates historical package manifests against exact npm registry patch release dates using Node.js's real semver engine (satisfies() / intersects()) via subprocess invocation to ensure exact semantic accuracy.

Categories tracked:

1. auto_fix: Range satisfies the patched version immediately ($T \approx 0$).
2. major_locked: Range does not intersect the major version bounds of the fix.
3. narrow_range: Same major version, but bounds are too restrictive to include the fix.
4. missing_range: Unparsable or missing range declarations.

Key Results & Methodological Comparison

Metric / Scope	Task 3 (Flat Ecosystem Sample)	Task 4 (Depth-Expanded Graph Traversal)
Scope Evaluated	Flat cross-section of direct dependents across independent advisories	Depth-expanded network subgraph originating from core infrastructure packages (up to depth 5)
Primary Constraint	Dominated by narrow ranges (68.5%)	Dominated by permissive loose ranges (^)
Auto-Fix Share	22.70%	31.83%

Quick Start

Install Python dependencies:

pip install -r requirements.txt