"I wasn't sure if this is indeed a security risk": Data-driven Understanding of Security Issue Reporting in GitHub Repositories of Open Source npm Packages

Rajdeep Ghosh, Shiladitya De, Mainack Mondal

34th USENIX Security Symposium · Day 1

This paper presents a critical, data-driven investigation into the effectiveness and challenges of security issue reporting within the vast **npm (Node Package Manager)** ecosystem. Given npm's pivotal role in modern JavaScript development and its dense interdependencies, understanding how security vulnerabilities are identified, reported, and ultimately resolved is paramount. The research, conducted by Rajdeep Ghosh, Shiladitya De, and Mainack Mondal from IIT Kharagpur, exposes a significant disconnect between the actual prevalence of security-related issues and how they are formally recognized and addressed by package maintainers on GitHub.

AI review

Solid empirical work that quantifies something we all suspected but nobody bothered to measure properly: npm's security issue tagging is completely broken, and bots aren't fixing it. The 114x gap between tagged and actual security issues is the kind of number that should make GitHub product managers uncomfortable. Not groundbreaking technique, but useful ground truth.