{"id":"https://openalex.org/W4360770768","doi":"https://doi.org/10.1109/tnse.2023.3260880","title":"Vulnerability of Package Dependency Networks","display_name":"Vulnerability of Package Dependency Networks","publication_year":2023,"publication_date":"2023-01-01","ids":{"openalex":"https://openalex.org/W4360770768","doi":"https://doi.org/10.1109/tnse.2023.3260880"},"language":"en","primary_location":{"id":"doi:10.1109/tnse.2023.3260880","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2023.3260880","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://riubu.ubu.es/bitstream/10259/8213/1/Seto-IEEEtnse_2023.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5032148536","display_name":"Daniel Set\u00f3-Rey","orcid":"https://orcid.org/0000-0003-0369-0716"},"institutions":[{"id":"https://openalex.org/I46176106","display_name":"Universidad de Burgos","ror":"https://ror.org/049da5t36","country_code":"ES","type":"education","lineage":["https://openalex.org/I46176106"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Daniel Set\u00f3-Rey","raw_affiliation_strings":["Ingeniería Informática, Universidad de Burgos, Burgos, Spain"],"raw_orcid":"https://orcid.org/0000-0003-0369-0716","affiliations":[{"raw_affiliation_string":"Ingeniería Informática, Universidad de Burgos, Burgos, Spain","institution_ids":["https://openalex.org/I46176106"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5069581009","display_name":"Jos\u00e9 Ignacio Santos","orcid":"https://orcid.org/0000-0002-6653-043X"},"institutions":[{"id":"https://openalex.org/I46176106","display_name":"Universidad de Burgos","ror":"https://ror.org/049da5t36","country_code":"ES","type":"education","lineage":["https://openalex.org/I46176106"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Jos\u00e9 Ignacio Santos-Mart\u00edn","raw_affiliation_strings":["Ingeniería de Organización, Universidad de Burgos, Burgos, Spain"],"raw_orcid":"https://orcid.org/0000-0002-6653-043X","affiliations":[{"raw_affiliation_string":"Ingeniería de Organización, Universidad de Burgos, Burgos, Spain","institution_ids":["https://openalex.org/I46176106"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5002350570","display_name":"Carlos L\u00f3pez Nozal","orcid":"https://orcid.org/0000-0001-8462-212X"},"institutions":[{"id":"https://openalex.org/I46176106","display_name":"Universidad de Burgos","ror":"https://ror.org/049da5t36","country_code":"ES","type":"education","lineage":["https://openalex.org/I46176106"]}],"countries":["ES"],"is_corresponding":false,"raw_author_name":"Carlos L\u00f3pez-Nozal","raw_affiliation_strings":["Ingeniería Informática, Universidad de Burgos, Burgos, Spain"],"raw_orcid":"https://orcid.org/0000-0001-8462-212X","affiliations":[{"raw_affiliation_string":"Ingeniería Informática, Universidad de Burgos, Burgos, Spain","institution_ids":["https://openalex.org/I46176106"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":1,"corresponding_author_ids":[],"corresponding_institution_ids":["https://openalex.org/I46176106"],"apc_list":{"value":2645,"currency":"USD","value_usd":2645},"apc_paid":null,"fwci":0.8592,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.77859407,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":95},"biblio":{"volume":null,"issue":null,"first_page":"1","last_page":"13"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9941999912261963,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.949400007724762,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.9487000107765198,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7310149073600769},{"id":"https://openalex.org/keywords/giant-component","display_name":"Giant component","score":0.6260986924171448},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6163532733917236},{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.608404815196991},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.5795946717262268},{"id":"https://openalex.org/keywords/reuse","display_name":"Reuse","score":0.5658238530158997},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.5476932525634766},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.5342611074447632},{"id":"https://openalex.org/keywords/vulnerability-management","display_name":"Vulnerability management","score":0.4543735682964325},{"id":"https://openalex.org/keywords/component-based-software-engineering","display_name":"Component-based software engineering","score":0.4380796253681183},{"id":"https://openalex.org/keywords/software-development","display_name":"Software development","score":0.3925444483757019},{"id":"https://openalex.org/keywords/distributed-computing","display_name":"Distributed computing","score":0.35873427987098694},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.3432088792324066},{"id":"https://openalex.org/keywords/vulnerability-assessment","display_name":"Vulnerability assessment","score":0.31042546033859253},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.3052627444267273},{"id":"https://openalex.org/keywords/random-graph","display_name":"Random graph","score":0.2927998900413513},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.2456752061843872},{"id":"https://openalex.org/keywords/psychological-resilience","display_name":"Psychological resilience","score":0.10073328018188477},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.09717732667922974}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7310149073600769},{"id":"https://openalex.org/C148818006","wikidata":"https://www.wikidata.org/wiki/Q4137985","display_name":"Giant component","level":4,"score":0.6260986924171448},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6163532733917236},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.608404815196991},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.5795946717262268},{"id":"https://openalex.org/C206588197","wikidata":"https://www.wikidata.org/wiki/Q846574","display_name":"Reuse","level":2,"score":0.5658238530158997},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.5476932525634766},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.5342611074447632},{"id":"https://openalex.org/C172776598","wikidata":"https://www.wikidata.org/wiki/Q7943570","display_name":"Vulnerability management","level":4,"score":0.4543735682964325},{"id":"https://openalex.org/C174683762","wikidata":"https://www.wikidata.org/wiki/Q609588","display_name":"Component-based software engineering","level":4,"score":0.4380796253681183},{"id":"https://openalex.org/C529173508","wikidata":"https://www.wikidata.org/wiki/Q638608","display_name":"Software development","level":3,"score":0.3925444483757019},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.35873427987098694},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.3432088792324066},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.31042546033859253},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.3052627444267273},{"id":"https://openalex.org/C47458327","wikidata":"https://www.wikidata.org/wiki/Q910404","display_name":"Random graph","level":3,"score":0.2927998900413513},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2456752061843872},{"id":"https://openalex.org/C137176749","wikidata":"https://www.wikidata.org/wiki/Q4105337","display_name":"Psychological resilience","level":2,"score":0.10073328018188477},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.09717732667922974},{"id":"https://openalex.org/C121332964","wikidata":"https://www.wikidata.org/wiki/Q413","display_name":"Physics","level":0,"score":0.0},{"id":"https://openalex.org/C542102704","wikidata":"https://www.wikidata.org/wiki/Q183257","display_name":"Psychotherapist","level":1,"score":0.0},{"id":"https://openalex.org/C97355855","wikidata":"https://www.wikidata.org/wiki/Q11473","display_name":"Thermodynamics","level":1,"score":0.0},{"id":"https://openalex.org/C548081761","wikidata":"https://www.wikidata.org/wiki/Q180388","display_name":"Waste management","level":1,"score":0.0},{"id":"https://openalex.org/C15744967","wikidata":"https://www.wikidata.org/wiki/Q9418","display_name":"Psychology","level":0,"score":0.0},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.0},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1109/tnse.2023.3260880","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnse.2023.3260880","pdf_url":null,"source":{"id":"https://openalex.org/S2484352698","display_name":"IEEE Transactions on Network Science and Engineering","issn_l":"2327-4697","issn":["2327-4697","2334-329X"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Network Science and Engineering","raw_type":"journal-article"},{"id":"pmh:oai:riubu.ubu.es:10259/8213","is_oa":true,"landing_page_url":"http://hdl.handle.net/10259/8213","pdf_url":"https://riubu.ubu.es/bitstream/10259/8213/1/Seto-IEEEtnse_2023.pdf","source":{"id":"https://openalex.org/S4306400051","display_name":"Repositorio Institucional de la Universidad de Burgos (University of Burgos)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I46176106","host_organization_name":"Universidad de Burgos","host_organization_lineage":["https://openalex.org/I46176106"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"pmh:oai:riubu.ubu.es:10259/8213","is_oa":true,"landing_page_url":"http://hdl.handle.net/10259/8213","pdf_url":"https://riubu.ubu.es/bitstream/10259/8213/1/Seto-IEEEtnse_2023.pdf","source":{"id":"https://openalex.org/S4306400051","display_name":"Repositorio Institucional de la Universidad de Burgos (University of Burgos)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I46176106","host_organization_name":"Universidad de Burgos","host_organization_lineage":["https://openalex.org/I46176106"],"host_organization_lineage_names":[],"type":"repository"},"license":"other-oa","license_id":"https://openalex.org/licenses/other-oa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"","raw_type":"info:eu-repo/semantics/article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/15","display_name":"Life in Land","score":0.6100000143051147}],"awards":[{"id":"https://openalex.org/G1615136708","display_name":null,"funder_award_id":"RED2018-102518-T","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G2262748287","display_name":null,"funder_award_id":"501100011033","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G3480869486","display_name":null,"funder_award_id":"13039","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G4137094306","display_name":null,"funder_award_id":"PID2020- 119894 GB-I00","funder_id":"https://openalex.org/F4320315062","funder_display_name":"Ministerio de Ciencia, Innovaci\u00f3n y Universidades"},{"id":"https://openalex.org/G425668148","display_name":null,"funder_award_id":".13039/501100011033","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G6731524417","display_name":null,"funder_award_id":"PID2020","funder_id":"https://openalex.org/F4320315062","funder_display_name":"Ministerio de Ciencia, Innovaci\u00f3n y Universidades"},{"id":"https://openalex.org/G7084143925","display_name":null,"funder_award_id":"AEI/10","funder_id":"https://openalex.org/F4320335598","funder_display_name":"Agencia Estatal de Investigaci\u00f3n"},{"id":"https://openalex.org/G7863371703","display_name":null,"funder_award_id":".13039/501100011033","funder_id":"https://openalex.org/F4320315062","funder_display_name":"Ministerio de Ciencia, Innovaci\u00f3n y Universidades"},{"id":"https://openalex.org/G8497050386","display_name":null,"funder_award_id":"501100011033","funder_id":"https://openalex.org/F4320315062","funder_display_name":"Ministerio de Ciencia, Innovaci\u00f3n y Universidades"}],"funders":[{"id":"https://openalex.org/F4320315062","display_name":"Ministerio de Ciencia, Innovaci\u00f3n y Universidades","ror":null},{"id":"https://openalex.org/F4320328351","display_name":"Junta de Castilla y Le\u00f3n","ror":"https://ror.org/02s8dab97"},{"id":"https://openalex.org/F4320335598","display_name":"Agencia Estatal de Investigaci\u00f3n","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4360770768.pdf","grobid_xml":"https://content.openalex.org/works/W4360770768.grobid-xml"},"referenced_works_count":64,"referenced_works":["https://openalex.org/W1544632947","https://openalex.org/W1544789779","https://openalex.org/W1550797871","https://openalex.org/W1680189815","https://openalex.org/W1715846772","https://openalex.org/W1899594931","https://openalex.org/W1932416503","https://openalex.org/W1971937094","https://openalex.org/W1989385531","https://openalex.org/W2011379509","https://openalex.org/W2030539428","https://openalex.org/W2034586501","https://openalex.org/W2052828895","https://openalex.org/W2065769502","https://openalex.org/W2069576934","https://openalex.org/W2070207525","https://openalex.org/W2070722739","https://openalex.org/W2070992781","https://openalex.org/W2112736324","https://openalex.org/W2114696370","https://openalex.org/W2118382442","https://openalex.org/W2141113219","https://openalex.org/W2144885342","https://openalex.org/W2145416273","https://openalex.org/W2152759400","https://openalex.org/W2153336132","https://openalex.org/W2320380086","https://openalex.org/W2400282174","https://openalex.org/W2490232925","https://openalex.org/W2548749170","https://openalex.org/W2733373979","https://openalex.org/W2740279154","https://openalex.org/W2796071471","https://openalex.org/W2801591443","https://openalex.org/W2920949083","https://openalex.org/W2963748706","https://openalex.org/W3000045849","https://openalex.org/W3007572456","https://openalex.org/W3014410422","https://openalex.org/W3036710213","https://openalex.org/W3040158574","https://openalex.org/W3100852074","https://openalex.org/W3111853352","https://openalex.org/W3123506665","https://openalex.org/W3124498556","https://openalex.org/W3138230581","https://openalex.org/W3143219376","https://openalex.org/W3144145236","https://openalex.org/W3144273096","https://openalex.org/W3159300567","https://openalex.org/W3162867182","https://openalex.org/W3184420437","https://openalex.org/W4206071945","https://openalex.org/W4220689618","https://openalex.org/W4238452917","https://openalex.org/W4283659102","https://openalex.org/W4302087791","https://openalex.org/W6644040475","https://openalex.org/W6668704902","https://openalex.org/W6676902811","https://openalex.org/W6685414272","https://openalex.org/W6759246942","https://openalex.org/W6760539209","https://openalex.org/W6779720062"],"related_works":["https://openalex.org/W2393340519","https://openalex.org/W2390459954","https://openalex.org/W4220885008","https://openalex.org/W2057803998","https://openalex.org/W4298219515","https://openalex.org/W2021298062","https://openalex.org/W1613146948","https://openalex.org/W3118510577","https://openalex.org/W2185499427","https://openalex.org/W4388541873"],"abstract_inverted_index":{"Software":[0],"reuse":[1],"by":[2],"importing":[3],"packages":[4],"from":[5,37,58,73,113],"centralised":[6],"repositories":[7,117,186],"is":[8,149,165],"an":[9],"efficient":[10],"and":[11,78,80,118,187],"increasingly":[12],"widespread":[13],"way":[14],"to":[15,124,134,179,192],"develop":[16],"software.":[17],"Given":[18],"the":[19,26,33,50,55,59,67,83,95,114,130,144,157],"transitivity":[20],"of":[21,45,62,85,94,104,132,160,162,183],"dependencies,":[22],"defects":[23],"introduced":[24],"in":[25,69],"repository":[27,46,56],"can":[28,168],"have":[29,121],"extensive":[30],"effects":[31],"on":[32,49],"software":[34,63,184],"ecosystem.":[35],"Drawing":[36],"complex":[38],"network":[39],"theory,":[40],"we":[41,98,127,154],"define":[42],"a":[43,86,180,196],"model":[44,68,129,177],"vulnerability":[47,112],"based":[48],"statistically":[51],"expected":[52],"damage":[53],"that":[54,82,100,156],"sustains":[57],"random":[60],"introduction":[61],"defects.":[64],"We":[65],"test":[66],"stylized":[70],"networks":[71],"derived":[72],"real":[74],"repositories,":[75],"PyPI,":[76],"Maven":[77],"npm,":[79],"show":[81],"existence":[84],"giant":[87,145],"strongly":[88],"connected":[89],"component":[90,107],"(SCC)":[91],"explains":[92],"most":[93],"vulnerability.":[96],"Indeed,":[97],"found":[99],"theoretical":[101],"protection":[102,148],"(immunization)":[103],"this":[105],"entire":[106],"would":[108],"remove":[109],"almost":[110],"all":[111],"network.":[115],"Since":[116],"their":[119],"communities":[120],"limited":[122],"resources":[123],"mitigate":[125],"issues,":[126],"further":[128],"problem":[131],"how":[133],"best":[135],"apply":[136],"these":[137],"resources,":[138],"finding":[139],"sets":[140,161],"much":[141],"smaller":[142],"than":[143],"SCC":[146],"whose":[147],"nearly":[150],"as":[151],"good.":[152],"Furthermore,":[153],"prove":[155],"optimal":[158],"selection":[159],"given":[163],"size":[164],"NP-Hard":[166],"but":[167],"be":[169,190],"approached":[170],"with":[171,195],"heuristics,":[172],"yielding":[173],"respectable":[174],"results.":[175],"Our":[176],"contributes":[178],"better":[181],"understanding":[182],"package":[185],"could":[188],"also":[189],"applied":[191],"other":[193],"systems":[194],"similar":[197],"structure.":[198]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1}],"updated_date":"2026-08-25T07:29:55.448023","created_date":"2025-10-10T00:00:00"}