{"id":"https://openalex.org/W4309529433","doi":"https://doi.org/10.1145/3571848","title":"On the Discoverability of npm Vulnerabilities in Node.js Projects","display_name":"On the Discoverability of npm Vulnerabilities in Node.js Projects","publication_year":2022,"publication_date":"2022-11-21","ids":{"openalex":"https://openalex.org/W4309529433","doi":"https://doi.org/10.1145/3571848"},"language":"en","primary_location":{"id":"doi:10.1145/3571848","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3571848","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5091616761","display_name":"Mahmoud Alfadel","orcid":"https://orcid.org/0000-0002-2621-6104"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Mahmoud Alfadel","raw_affiliation_strings":["Concordia University, Canada"],"raw_orcid":"https://orcid.org/0000-0002-2621-6104","affiliations":[{"raw_affiliation_string":"Concordia University, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023951345","display_name":"Diego Elias Costa","orcid":"https://orcid.org/0000-0001-7084-2594"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Diego Elias Costa","raw_affiliation_strings":["Concordia University, Canada"],"raw_orcid":"https://orcid.org/0000-0001-7084-2594","affiliations":[{"raw_affiliation_string":"Concordia University, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5049727493","display_name":"Emad Shihab","orcid":"https://orcid.org/0000-0003-1285-9878"},"institutions":[{"id":"https://openalex.org/I60158472","display_name":"Concordia University","ror":"https://ror.org/0420zvk78","country_code":"CA","type":"education","lineage":["https://openalex.org/I60158472"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Emad Shihab","raw_affiliation_strings":["Concordia University, Canada"],"raw_orcid":"https://orcid.org/0000-0003-1285-9878","affiliations":[{"raw_affiliation_string":"Concordia University, Canada","institution_ids":["https://openalex.org/I60158472"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5058164381","display_name":"Bram Adams","orcid":"https://orcid.org/0000-0001-7213-4006"},"institutions":[{"id":"https://openalex.org/I204722609","display_name":"Queen's University","ror":"https://ror.org/02y72wh86","country_code":"CA","type":"education","lineage":["https://openalex.org/I204722609"]}],"countries":["CA"],"is_corresponding":false,"raw_author_name":"Bram Adams","raw_affiliation_strings":["Queen\u2019s University, Canada","Queen's University, Canada"],"raw_orcid":"https://orcid.org/0000-0001-7213-4006","affiliations":[{"raw_affiliation_string":"Queen\u2019s University, Canada","institution_ids":["https://openalex.org/I204722609"]},{"raw_affiliation_string":"Queen's University, Canada","institution_ids":["https://openalex.org/I204722609"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.3585,"has_fulltext":false,"cited_by_count":16,"citation_normalized_percentile":{"value":0.94865757,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":99},"biblio":{"volume":"32","issue":"4","first_page":"1","last_page":"27"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.9995999932289124,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.9990000128746033,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.9979000091552734,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/discoverability","display_name":"Discoverability","score":0.9780670404434204},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7887284755706787},{"id":"https://openalex.org/keywords/dependency","display_name":"Dependency (UML)","score":0.5536410212516785},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5133618712425232},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.4967053532600403},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.31091928482055664},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.18746119737625122}],"concepts":[{"id":"https://openalex.org/C2778531742","wikidata":"https://www.wikidata.org/wiki/Q17009281","display_name":"Discoverability","level":2,"score":0.9780670404434204},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7887284755706787},{"id":"https://openalex.org/C19768560","wikidata":"https://www.wikidata.org/wiki/Q320727","display_name":"Dependency (UML)","level":2,"score":0.5536410212516785},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5133618712425232},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4967053532600403},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.31091928482055664},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.18746119737625122}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3571848","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3571848","pdf_url":null,"source":{"id":"https://openalex.org/S142627899","display_name":"ACM Transactions on Software Engineering and Methodology","issn_l":"1049-331X","issn":["1049-331X","1557-7392"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319798","host_organization_name":"Association for Computing Machinery","host_organization_lineage":["https://openalex.org/P4310319798"],"host_organization_lineage_names":["Association for Computing Machinery"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"ACM Transactions on Software Engineering and Methodology","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":38,"referenced_works":["https://openalex.org/W1792587773","https://openalex.org/W2077229393","https://openalex.org/W2092615763","https://openalex.org/W2112736324","https://openalex.org/W2140952846","https://openalex.org/W2400282174","https://openalex.org/W2615381372","https://openalex.org/W2756234923","https://openalex.org/W2789570312","https://openalex.org/W2898029226","https://openalex.org/W2899462170","https://openalex.org/W2921999452","https://openalex.org/W2945486631","https://openalex.org/W2963321189","https://openalex.org/W2963748706","https://openalex.org/W2964080672","https://openalex.org/W2967160941","https://openalex.org/W2989443621","https://openalex.org/W3014355281","https://openalex.org/W3036270494","https://openalex.org/W3040158574","https://openalex.org/W3087431727","https://openalex.org/W3094949573","https://openalex.org/W3106855263","https://openalex.org/W3121596715","https://openalex.org/W3125307739","https://openalex.org/W3144273096","https://openalex.org/W3148779029","https://openalex.org/W3150814957","https://openalex.org/W3162867182","https://openalex.org/W3177321543","https://openalex.org/W3184420437","https://openalex.org/W3194926883","https://openalex.org/W4220682629","https://openalex.org/W4226410005","https://openalex.org/W4230313626","https://openalex.org/W4244548826","https://openalex.org/W4293241248"],"related_works":["https://openalex.org/W2748952813","https://openalex.org/W2104270606","https://openalex.org/W2412397182","https://openalex.org/W4366968117","https://openalex.org/W4226232118","https://openalex.org/W1515631954","https://openalex.org/W2191065564","https://openalex.org/W4387666693","https://openalex.org/W973446453","https://openalex.org/W2920877081"],"abstract_inverted_index":{"The":[0,124],"reliance":[1],"on":[2,91,110],"vulnerable":[3,112],"dependencies":[4,120,193],"is":[5,25,135,148],"a":[6,54,77,146,167,176],"major":[7,125],"threat":[8],"to":[9,30,43,46,58,119,184],"software":[10,62],"systems.":[11],"Dependency":[12],"vulnerabilities":[13,60,92,134,165,189],"are":[14],"common":[15],"and":[16,27,40,96,194],"remain":[17,161],"undisclosed":[18,111],"for":[19,127,166],"years.":[20],"However,":[21],"once":[22],"the":[23,31,33,48,67,70,102,105,128,136,144],"vulnerability":[24],"discovered":[26],"publicly":[28],"known":[29],"community,":[32],"risk":[34],"of":[35,56,104,138,143],"exploitation":[36],"reaches":[37],"its":[38],"peak,":[39],"developers":[41,186],"have":[42,65],"work":[44],"fast":[45],"remediate":[47],"problem.":[49],"While":[50],"there":[51],"has":[52],"been":[53],"lot":[55],"research":[57],"characterize":[59],"in":[61,141,190],"ecosystems,":[63],"none":[64],"explored":[66],"problem":[68],"taking":[69],"discoverability":[71,88,181],"into":[72],"account.":[73],"Therefore,":[74],"we":[75,157,173],"perform":[76],"large-scale":[78],"empirical":[79],"study":[80],"examining":[81],"6,546":[82],"Node.js":[83],"applications.":[84],"We":[85,98],"define":[86],"three":[87],"levels":[89],"based":[90],"lifecycle":[93],"(undisclosed,":[94],"reported,":[95],"public).":[97],"find":[99,158],"that":[100,159,178],"although":[101],"majority":[103],"affected":[106,131,162],"applications":[107,116,129,160],"(99.42%)":[108],"depend":[109],"packages,":[113],"206":[114],"(4.63%)":[115],"were":[117],"exposed":[118],"with":[121],"public":[122,133,164],"vulnerabilities.":[123],"culprit":[126],"being":[130],"by":[132,153,163],"lack":[137],"dependency":[139],"updates;":[140],"90.8%":[142],"cases,":[145],"fix":[147],"available":[149],"but":[150],"not":[151],"patched":[152],"application":[154,192],"maintainers.":[155],"Moreover,":[156],"long":[168],"time":[169],"(103":[170],"days).":[171],"Finally,":[172],"devise":[174],"DepReveal,":[175],"tool":[177],"supports":[179],"our":[180],"analysis":[182],"approach,":[183],"help":[185],"better":[187],"understand":[188],"their":[191,196],"plan":[195],"project":[197],"maintenance.":[198]},"counts_by_year":[{"year":2026,"cited_by_count":2},{"year":2025,"cited_by_count":8},{"year":2024,"cited_by_count":3},{"year":2023,"cited_by_count":3}],"updated_date":"2026-07-15T18:14:33.161393","created_date":"2025-10-10T00:00:00"}