A 2024/2025 replication of Massacci and Pashchenko's technical-leverage study on the npm ecosystem (Samaana et al.) found that high-leverage JavaScript libraries face 4-7x higher vulnerability exposure than low-leverage ones, but it measured only direct plus level-1 transitive dependencies and attributed vulnerabilities by dependency presence, which yields a conservative upper bound because much vulnerable code is never reached by dependents. The open problem is to determine how the opportunities and risks of technical leverage in npm change when measured over the full (level-2 and deeper) transitive dependency closure and conditioned on whether vulnerable code in dependencies is actually reachable — which in turn requires precise, scalable reachability analysis for JavaScript at npm ecosystem scale, a capability that exists for Java/Maven (where under 1% of packages have a reachable call path to vulnerable code) but not for JavaScript.

Background

npm (originally the Node Package Manager) is the package registry for the Node.js/JavaScript ecosystem, the largest software ecosystem in existence, with over two million reusable packages. A package's direct dependencies are the packages it explicitly lists in its manifest; transitive dependencies are the dependencies of those dependencies, resolved recursively according to semantic versioning constraints, so a project that declares only a handful of direct dependencies can end up executing code from dozens or hundreds of packages.

Technical leverage, introduced by Massacci and Pashchenko (ICSE 2021) for the Java/Maven ecosystem, is the ratio of code borrowed from free and open-source software (FOSS) dependencies to the code written by the project's own maintainers: a library with leverage 2.5 ships 2.5 lines of other people's code for every line of its own. Their study of Maven showed a clear trade-off: high-leverage projects ship more code without large release delays, but are about 60% more likely to become vulnerable. Samaana, Costa, Abdellatif and Shihab (Empirical Software Engineering 30(4):96, 2025; arXiv:2412.06948) replicated this study on npm, analyzing 14,042 releases of the 142 most-depended-upon npm libraries. They found both opportunities and risks magnified relative to Maven: small-medium libraries leverage a median of 2.5x FOSS code, high leverage shortens the release cycle, and the risk of vulnerability exposure is 4-7x higher for high-leverage libraries under direct-dependency analysis (4x for small-to-medium libraries, 7.6x for large ones), rising to 6.7x and 21x respectively when the first level of transitive dependencies is included.

Two methodological limits qualify these numbers. First, depth: because full transitive dependency networks are computationally expensive to resolve at ecosystem scale, the replication included only level-1 transitive dependencies, so the quantitative impact of level-2 and deeper dependencies on measured leverage and on vulnerability odds is unknown. Second, granularity: vulnerabilities were attributed to a library whenever a dependency (direct or level-1 transitive) contained a version with a known security advisory, taken from vulnerability databases such as Snyk or the Google OSV database. This dependency-presence attribution overcounts: a vulnerability matters only if the vulnerable code is actually executed. Deciding that requires a call graph — a static over-approximation of the function-level calls a program can make — combined with localization of the advisory to the vulnerable functions. For Maven, Mir, Keshani and Proksch (arXiv:2301.07972) did exactly this at scale (3 million packages, full transitive closure, whole-program call graphs) and found that although one third of packages are flagged vulnerable only once transitive dependencies are considered, under 1% have a reachable call path to vulnerable code — orders of magnitude below dependency-based counts. For JavaScript, no comparable ecosystem-scale capability exists: the only npm function-call reachability study, SōjiTantei by Chinthanet et al. (IEICE Transactions on Information and Systems, 2022), covered 78 vulnerability cases and 780 client projects with 83.3% accuracy. Ecosystem-scale npm studies that do resolve full dependency trees, such as Liu et al.'s DVGraph, a dependency-vulnerability knowledge graph covering the whole npm ecosystem (ICSE 2022, over 10 million library versions and 60 million resolved dependency relations) and the recent propagation study of Robinson et al. (AsiaCCS 2026, about 1.08 million packages), still quantify vulnerability propagation at the dependency-presence level, not at the level of reachable code. The consequence is that the leverage-risk association reported for npm — like all dependency-based npm risk measurements — remains an upper bound whose tightness is unknown, and the leverage framework itself is unquantified beyond level-1 transitivity.

Problem Statement

Determine how the opportunities and risks of technical leverage in the npm ecosystem change when measured (a) over the full transitive dependency closure — level 2 and deeper, not only direct and level-1 dependencies — and (b) at the granularity of actually-used code, replacing dependency-presence vulnerability attribution with attribution conditioned on whether the vulnerable code in a (transitive) dependency is reachable from the dependent project.

This single objective couples two deliverables. First, a measurement capability: a method that determines, for JavaScript projects, whether vulnerable code paths in transitive dependencies are reachable, demonstrated over the full transitive dependency closure of the same library cohort used by the second deliverable, with its precision and recall reported against a manually labelled sample of reachability instances drawn from that closure — that is, the JavaScript/npm counterpart of Mir et al.'s Maven analysis, which resolved full transitive closures and whole-program call graphs for 3 million packages. Second, the scientific payoff built on it: a re-quantification, under full dependency depth and reachability-informed exposure, of the technical-leverage framework of Massacci-Pashchenko as replicated by Samaana et al. on npm over the same library cohort and measurement conventions — the leverage distribution of libraries, the association between leverage and release interval, and the vulnerability odds for high- versus low-leverage libraries — establishing whether the reported magnitudes (e.g., the 4-7x vulnerability risk under direct-dependency analysis, rising to 6.7x for small-to-medium libraries and 21x for large ones with level-1 transitive dependencies, set against the under-1% reachable fraction found for Maven) survive, shrink, or disappear when the conservative upper bound is removed and deeper dependency levels are included.

The objective is to establish how much of the npm leverage-risk association is real and how much is an artifact of depth-truncated, usage-blind measurement. Dependency-presence proxies (e.g., dependency counts alone) and single-project case studies do not answer it: the question is precisely whether ecosystem-scale, code-level measurement over the full transitive closure changes the reported figures.

References

  1. Samaana, Haya; Costa, Diego Elias; Abdellatif, Ahmad; Shihab, Emad. "Opportunities and security risks of technical leverage: A replication study on the NPM ecosystem." Empirical Software Engineering 30(4):96, 2025. DOI: 10.1007/s10664-025-10648-8. https://doi.org/10.1007/s10664-025-10648-8 (preprint arXiv:2412.06948, https://arxiv.org/abs/2412.06948)
  2. Massacci, Fabio; Pashchenko, Ivan. "Technical Leverage in a Software Ecosystem: Development Opportunities and Security Risks." In 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE), pp. 1386-1397, 2021. DOI: 10.1109/ICSE43902.2021.00125. https://doi.org/10.1109/ICSE43902.2021.00125
  3. Mir, Amir M.; Keshani, Mehdi; Proksch, Sebastian. "On the Effect of Transitivity and Granularity on Vulnerability Propagation in the Maven Ecosystem." arXiv:2301.07972, 2023. https://arxiv.org/abs/2301.07972
  4. Liu, Chengwei; Chen, Sen; Fan, Lingling; Chen, Bihuan; Liu, Yang; Peng, Xin. "Demystifying the vulnerability propagation and its evolution via dependency trees in the NPM ecosystem." In Proceedings of the 44th International Conference on Software Engineering (ICSE 2022), pp. 672-684, 2022. DOI: 10.1145/3510003.3510142. https://doi.org/10.1145/3510003.3510142
  5. Chinthanet, Bodin; Kula, Raula Gaikovina; Zapata, Rodrigo Eliza; Ishio, Takashi; Matsumoto, Kenichi; Ihara, Akinori. "SōjiTantei: Function-Call Reachability Detection of Vulnerable Code for npm Packages." IEICE Transactions on Information and Systems E105-D(1):19-20, 2022. DOI: 10.1587/transinf.2021mpl0001. https://doi.org/10.1587/transinf.2021mpl0001 (preprint arXiv:2109.08931, https://arxiv.org/abs/2109.08931)
  6. Chinthanet, Bodin; Ponta, Serena Elisa; Plate, Henrik; Sabetta, Antonino; Kula, Raula Gaikovina; Ishio, Takashi; Matsumoto, Kenichi. "Code-based Vulnerability Detection in Node.js Applications: How far are we?" arXiv:2008.04568, 2020. https://arxiv.org/abs/2008.04568
  7. Paramitha, Ranindya; Massacci, Fabio. "Technical leverage analysis in the Python ecosystem." Empirical Software Engineering 28(6):139, 2023. DOI: 10.1007/s10664-023-10355-2. https://doi.org/10.1007/s10664-023-10355-2
  8. Zimmermann, Markus; Staicu, Cristian-Alexandru; Tenny, Cam; Pradel, Michael. "Small World with High Risks: A Study of Security Threats in the npm Ecosystem." In 28th USENIX Security Symposium, pp. 995-1010, 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/zimmerman
  9. Kluban, Maryna; Mannan, Mohammad; Youssef, Amr. "On Measuring Vulnerable JavaScript Functions in the Wild." In Proceedings of the 2022 ACM Asia Conference on Computer and Communications Security (AsiaCCS), pp. 917-930, 2022. DOI: 10.1145/3488932.3497769. https://doi.org/10.1145/3488932.3497769
  10. Robinson, Michael; Halder, Sajal; Ahmed, Muhammad Ejaz; Ikram, Muhammad; Camtepe, Seyit; Kim, Hyoungshick. "Original Sin of npm: A Study on Vulnerability Propagation in JavaScript Dependency Networks." In Proceedings of the ACM Asia Conference on Computer and Communications Security (AsiaCCS), pp. 1213-1227, 2026. DOI: 10.1145/3779208.3785388. https://doi.org/10.1145/3779208.3785388
  11. Decan, Alexandre; Mens, Tom; Constantinou, Eleni. "On the impact of security vulnerabilities in the npm package dependency network." In Proceedings of the 15th International Conference on Mining Software Repositories (MSR), pp. 181-191, 2018. DOI: 10.1145/3196398.3196401. https://doi.org/10.1145/3196398.3196401
  12. Gamage, Yogya; Ben Chauben, Meriem; Monperrus, Martin; Baudry, Benoit. "FIKA: Expanding Dependency Reachability with Executability Guarantees." arXiv:2604.20015, 2026. https://arxiv.org/abs/2604.20015
  13. Patel, Harshvardhan; Snit, Alexander; Polychronakis, Michalis. "Supply Chain Reaction: Enhancing the Precision of Vulnerability Triage using Code Reachability Information." In 2025 IEEE Annual Computer Security Applications Conference (ACSAC), pp. 92-107, 2025. DOI: 10.1109/ACSAC67867.2025.00023. https://doi.org/10.1109/ACSAC67867.2025.00023
  14. Jia, Zhizhuang; Yang, Chao; Feng, Pengbin; Zhao, Xiaoyun; Li, Xinghua; Ma, Jianfeng. "Impact assessment of third-party library vulnerabilities through vulnerability reachability analysis." Computers & Security 157:104546, 2025. DOI: 10.1016/j.cose.2025.104546. https://doi.org/10.1016/j.cose.2025.104546