DOCSLIB.ORG

Npm Packages As Ingredients: a Recipe-Based Approach

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Npm Packages As Ingredients: a Recipe-Based Approach npm Packages as Ingredients: A Recipe-based Approach Kyriakos C. Chatzidimitriou, Michail D. Papamichail, Themistoklis Diamantopoulos, Napoleon-Christos Oikonomou and Andreas L. Symeonidis Electrical and Computer Engineering Dept., Aristotle University of Thessaloniki, Thessaloniki, Greece Keywords: Dependency Networks, Software Reuse, JavaScript, npm, Node. Abstract: The sharing and growth of open source software packages in the npm JavaScript (JS) ecosystem has been exponential, not only in numbers but also in terms of interconnectivity, to the extend that often the size of de- pendencies has become more than the size of the written code. This reuse-oriented paradigm, often attributed to the lack of a standard library in node and/or in the micropackaging culture of the ecosystem, yields interest- ing insights on the way developers build their packages. In this work we view the dependency network of the npm ecosystem from a “culinary” perspective. We assume that dependencies are the ingredients in a recipe, which corresponds to the produced software package. We employ network analysis and information retrieval techniques in order to capture the dependencies that tend to co-occur in the development of npm packages and identify the communities that have been evolved as the main drivers for npm’s exponential growth. 1 INTRODUCTION come very important in today’s software develop- ment process, npm registry has become a “must” The popularity of JS is constantly increasing, and place for developers to share packages, defining code along is increasing the popularity of frameworks for reuse as a state-of-the-practice development paradigm building server (e.g. Node.js), web (e.g. React, Vue.js, (Chatzidimitriou et al., 2018). A white paper by Con- Angular, etc.), desktop (e.g. Electron) or mobile ap- trast Security (Williams and Dabirsiaghi, 2014) men- plications (e.g. React Native, NativeScript, etc.), even tions that up to 80% of the code in today’s software IoT solutions (e.g. Node-RED). A common denom- applications comes from libraries and frameworks. inator to this explosive growth has been the launch This is evident in the npm ecosystem, where the num- of the npm registry (i.e. the package manager of JS) ber of dependencies for a package has been shown to in 2010. The npm ecosystem is often seen as one of grow with time (Wittern et al., 2016). There are even the JS revolutions1 that have transformed JavaScript extreme cases, where one-liner libraries have more from “a language that was adding programming ca- than 70 dependencies (Haney, 2016). Such extreme pabilities to HTML” into a full-blown ecosystem. In reusability is usually attributed to the lack of a stan- fact, the growth is so rapid that terms like “JS frame- dard library in node.js and to the micropackaging cul- work fatigue” have become common among develop- ture of the npm ecosystem. ers. Indicatively, the June 2018 Redmonk survey2, Against this background, in this work we extract the GitHub status report3, and the 2018 Stack Over- the collective knowledge and preferences when creat- flow survey4 position JS as the most popular program- ing JavaScript (node.js) packages through mining the ming language, while Module Counts5 depicts an ex- most proliferate module repository, the npm registry. ponential growth of npm modules against repositories Inspired by (Teng et al., 2012), we treat packages as of other languages. recipes and dependencies as ingredients. Just like a Given that dependencies and reusability have be- recipe comprises a list of ingredients along with a pro- 1https://youtu.be/L-fx2xXSVso cess on how to combine them, one can consider an 2https://redmonk.com/sogrady/2018/08/10/language- npm package as a recipe: a list of core dependencies rankings-6-18/ and a list of development dependencies, also known 3https://octoverse.github.com/ as devDependencies in the npm lingo, that are com- 4https://insights.stackoverflow.com/survey/2018/ bined together with some code that uses them. And 5http://www.modulecounts.com/ just like online recipes receive reviews and comments, 544 Chatzidimitriou, K., Papamichail, M., Diamantopoulos, T., Oikonomou, N. and Symeonidis, A. npm Packages as Ingredients: A Recipe-based Approach. DOI: 10.5220/0007966805440551 In Proceedings of the 14th International Conference on Software Technologies (ICSOFT 2019), pages 544-551 ISBN: 978-989-758-379-7 Copyright c 2019 by SCITEPRESS – Science and Technology Publications, Lda. All rights reserved npm Packages as Ingredients: A Recipe-based Approach npm packages have repository stars, forks, watchers code under development and other information (is- and package downloads, GitHub issues, Stack Over- sues, commits, stars, forks, watchers etc.). All the flow posts, and so on. This type of information can above hold true for node.js applications as well. That provide insights not only about package popularity or is, end-user applications that too have dependencies quality but also about user preferences, development and devDependencies and allow us to see package us- tendencies, and which dependencies go well with oth- age from an application developer viewpoint. ers. We focus on the following research questions: • RQ1: Are there any interesting communities (clus- ters) developed by dependencies that tend to co- 3 METHODOLOGY occur together in “recipes”? • RQ2: Is the same true for devDependencies? The target of our methodology is to distill the knowl- edge found in the package.json files of the npm reg- • RQ : Can we identify the scope these communi- 3 istry, with respect to their declared dependencies. To ties are used for? do so, we parse them and extract the dependencies and • RQ4: What are the similarities or differences be- devDependencies, the description and keywords that tween package recipes (node.js packages of the denote their functionality, along with certain meta- npm registry) and application recipes (node.js ap- data regarding package popularity. plications that are not part of the npm registry)? We construct four networks in order to capture By providing answers to these questions we aim to get developers’ practices about how they combine them: a better understanding of how packages work when one that reflects the relationships between dependen- used together as dependencies. We can also answer cies and one for devDependencies. This is performed questions as to which packages mix well together and twice one for npm packages and one for node.js ap- for what purpose. plications. Upon creating the networks, we employ cluster detection algorithms in order to find communi- ties of packages that are often used together and apply information retrieval techniques to the keywords and 2 BACKGROUND description fields in order to assign keywords of func- tionality to the communities. Last but not least, we try The npm registry6 is the largest and fastest growing to identify if employing frequently used dependencies module (or packages in the JS terminology) reposi- has any impact to the popularity of the produced pack- tory of all programming languages. At the moment of age in terms of GitHub stars or package downloads. writing it includes more than 800K packages, while more than 500 are added every day. Packages pub- 3.1 The Dataset lished to the registry must contain a package.json file. The main goals of the package.json7 file are: In such big open databases like npm, the quality and 1. to list the packages that the project depends on. usefulness of the packages usually follows a Power 8 9 2. to allow specifying the versions of a package that Law or the Pareto Principle . So in order to mine the project can use via semantic versioning rules. useful, quality packages, we augmented each pack- age with its monthly download count gathered from 3. to make one’s build reproducible, and therefore npms.io10 and the GitHub stars from the repository much easier to share with other developers. mentioned in the package.json file. Among other things, this file holds information, such Using popularity thresholds of 5;000 monthly as the package name and version, its description, the downloads and 70 GitHub stars, we extracted 8;732 authors, keywords, license, repository, and more. packages. The aforementioned thresholds were not Besides the dependencies, the package.json file arbitrarily selected, but were investigated using the contains a devDependencies list that accounts for elbow method based on the number of packages that packages used while developing the software project satisfy them. This number is exponentially increasing and not included in the “production” build of the when we further decrease those thresholds. For each product. Most often, the npm packages are associated package (recipe) we kept the name, its dependencies with a GitHub repository, which contains the source (ingredients), its devDependencies (another type of 6https://www.npmjs.com/ 8https://en.wikipedia.org/wiki/Power law 7https://docs.npmjs.com/getting-started/using-a- 9https://en.wikipedia.org/wiki/Pareto principle package.json 10https://api-docs.npms.io/ 545 ICSOFT 2019 - 14th International Conference on Software Technologies ingredients), the keywords and the description fields 3.2 Package Dependencies Complement found in the package.json file, augmented with its Network monthly downloads and the GitHub stars of the repos- itory declared in its package.json file. We only kept We constructed a dependency complement network the name of the package and the names of its de- based on the Pointwise Mutual Information (PMI) cri- pendencies and didn’t consider any declared semantic terion, defined on pairs of dependencies (a;b) as fol- version. As for the applications, by crawling GitHub, lows: we downloaded package.json files that were con- p(a;b) tained in the root folder of repositories with more PMI(a;b) = log (1) than 70 stars and their package names did not exist p(a)p(b) in the npm registry.
Load more

Recommended publications
  • Third Party Software Component List: Targeted Use: Briefcam® Fulfillment of License Obligation for All Open Sources: Yes
    Third Party Software Component List: Targeted use: BriefCam® Fulfillment of license obligation for all open sources: Yes Name Link and Copyright Notices Where Available License Type OpenCV https://opencv.org/license.html 3-Clause Copyright (C) 2000-2019, Intel Corporation, all BSD rights reserved. Copyright (C) 2009-2011, Willow Garage Inc., all rights reserved. Copyright (C) 2009-2016, NVIDIA Corporation, all rights reserved. Copyright (C) 2010-2013, Advanced Micro Devices, Inc., all rights reserved. Copyright (C) 2015-2016, OpenCV Foundation, all rights reserved. Copyright (C) 2015-2016, Itseez Inc., all rights reserved. Apache Logging http://logging.apache.org/log4cxx/license.html Apache Copyright © 1999-2012 Apache Software Foundation License V2 Google Test https://github.com/abseil/googletest/blob/master/google BSD* test/LICENSE Copyright 2008, Google Inc. SAML 2.0 component for https://github.com/jitbit/AspNetSaml/blob/master/LICEN MIT ASP.NET SE Copyright 2018 Jitbit LP Nvidia Video Codec https://github.com/lu-zero/nvidia-video- MIT codec/blob/master/LICENSE Copyright (c) 2016 NVIDIA Corporation FFMpeg 4 https://www.ffmpeg.org/legal.html LesserGPL FFmpeg is a trademark of Fabrice Bellard, originator v2.1 of the FFmpeg project 7zip.exe https://www.7-zip.org/license.txt LesserGPL 7-Zip Copyright (C) 1999-2019 Igor Pavlov v2.1/3- Clause BSD Infralution.Localization.Wp http://www.codeproject.com/info/cpol10.aspx CPOL f Copyright (C) 2018 Infralution Pty Ltd directShowlib .net https://github.com/pauldotknopf/DirectShow.NET/blob/ LesserGPL
    [Show full text]
  • Asp Net Jquery Ajax Json Example Wersja
    Asp Net Jquery Ajax Json Example Conquering and exculpatory Thorsten wited clumsily and prickle his heed unforcedly and soothingly. Unanswered and numinous Graig never conscripts observably when Bela shoals his luffas. Oligarchic and ben Ashton held so rifely that Simon sticky his bajada. Dbcontect classes to help, i am glad you will send ajax call will execute and the feedback. Scheduled tasks in asp jquery example will help make them together with an array of products table that will decrease automatically. Provides the asp net jquery json helper method, what the about. Via json format in asp net example given by microsoft json request is given by default name to your network have your data has a formatted result. Comment is shown the asp ajax json request to understand concept is the project, the article we click on the product details. Loads data types, ajax example is, the other articles. Into our method in asp net example we can get request and suggestions will not the future of response, for this by both the _layout. We should then the asp net ajax methods of errors potentially introduced by using chart with razor page without updating the class as an array of the div tag. Developer will call with jquery ajax json or with my things, then passes the database and the body. Message using and the example is the client side method can be the console. Year passed to use jquery json data you know what follows is providing different types in the year. Installing a controller folder and a button to products model, simple example below is, and then the _layout.
    [Show full text]
  • Front-End Development with ASP.NET Core, Angular, And
    Table of Contents COVER TITLE PAGE FOREWORD INTRODUCTION WHY WEB DEVELOPMENT REQUIRES POLYGLOT DEVELOPERS WHO THIS BOOK IS FOR WHAT THIS BOOK COVERS HOW THIS BOOK IS STRUCTURED WHAT YOU NEED TO USE THIS BOOK CONVENTIONS SOURCE CODE ERRATA 1 What’s New in ASP.NET Core MVC GETTING THE NAMES RIGHT A BRIEF HISTORY OF THE MICROSOFT .NET WEB STACK .NET CORE INTRODUCING ASP.NET CORE NEW FUNDAMENTAL FEATURES OF ASP.NET CORE AN OVERVIEW OF SOME ASP.NET CORE MIDDLEWARE ASP.NET CORE MVC SUMMARY 2 The Front‐End Developer Toolset ADDITIONAL LANGUAGES YOU HAVE TO KNOW JAVASCRIPT FRAMEWORKS CSS FRAMEWORKS PACKAGE MANAGERS TASK RUNNERS SUMMARY 3 Angular in a Nutshell ANGULAR CONCEPTS THE LANGUAGE OF ANGULAR SETTING UP AN ANGULAR PROJECT THE STRUCTURE OF AN ANGULAR APP DATA BINDING DIRECTIVES SERVICES AND DEPENDECY INJECTION MULTIPLE COMPONENTS INPUT AND OUTPUT PROPERTIES TALKING TO THE BACK END USING ANGULAR WITH ASP.NET MVC VISUAL STUDIO 2017 SUPPORT FOR ANGULAR SUMMARY 4 Bootstrap in a Nutshell INTRODUCTION TO BOOTSTRAP BOOTSTRAP STYLES COMPONENTS JAVASCRIPT CUSTOMIZING BOOTSTRAP WITH LESS BOOTSTRAP SUPPORT IN VISUAL STUDIO 2017 AND ASP.NET CORE SUMMARY 5 Managing Dependencies with NuGet and Bower GENERAL CONCEPTS NUGET NPM (NODE.JS PACKAGE MANAGER) BOWER SUMMARY 6 Building Your Application with Gulp and webpack WHAT FRONT‐END BUILD SYSTEMS ARE FOR A DEEPER LOOK AT GULP INTRODUCTION TO WEBPACK VISUAL STUDIO 2017 AND BUILD SYSTEMS SUMMARY 7 Deploying ASP.NET Core THE NEW HOSTING MODEL OF ASP.NET CORE INSTALLING ON INTERNET INFORMATION SERVICES ON PREMISE
    [Show full text]
  • ** OPEN SOURCE LIBRARIES USED in Tv.Verizon.Com/Watch
    ** OPEN SOURCE LIBRARIES USED IN tv.verizon.com/watch ------------------------------------------------------------ 02/27/2019 tv.verizon.com/watch uses Node.js 6.4 on the server side and React.js on the client- side. Both are Javascript frameworks. Below are the licenses and a list of the JS libraries being used. ** NODE.JS 6.4 ------------------------------------------------------------ https://github.com/nodejs/node/blob/master/LICENSE Node.js is licensed for use as follows: """ Copyright Node.js contributors. All rights reserved. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. """ This license applies to parts of Node.js originating from the https://github.com/joyent/node repository: """ Copyright Joyent, Inc. and other Node contributors.
    [Show full text]
  • Reasonml Install Guide Fall 2019
    CS17 Integrated Introduction to Computer Science Hughes ReasonML Install Guide Fall 2019 Contents 1 Install Guide (Windows) 1 1.1 Installing Node . .1 1.2 WSL.............................................1 1.3 Configuring Visual Studio Code . .2 2 Install Guide (Mac OSX) 2 2.1 Installing Visual Studio Code . .2 2.2 Installing Various XCode Tools (NVM, Node) . .2 2.3 Configuring Visual Studio Code . .5 3 Using ReasonML 5 3.1 Configuring Your Project . .5 3.2 Compiling ReasonML . .5 3.3 Running ReasonML . .5 4 Reason Tools (Browser) 6 1 Install Guide (Windows) 1.1 Installing Node Click here to install Node. 1.2 WSL Follow this guide to install Windows Subsystem for Linux (WSL). Select the Linux Distribution choice Ubuntu, which has an orange icon. Open the "Command Prompt" on your machine and type the following command. This can take a long time to install fully. Let it sit for some time, even if it appears as if it’s not doing anything. Feel free to move on to other steps while it loads. npm install - g ocaml - reason - wsl CS17 ReasonML Install Guide Fall 2019 Inside of Visual Studio Code go to Settings > User Settings. In the upper right-hand corner, click on the icon that looks like a file with an arrow wrapped around it. A window should open up with a file in it. Copy and paste the following lines into the file in between the curly braces and save the file. "reason.path.bsb":"bash - ic bsb", "reason.path.ocamlfind":"bash - ic ocamlfind", "reason.path.ocamlmerlin":"bash - ic ocamlmerlin", "reason.path.opam":"bash - ic opam", "reason.path.rebuild":"bash - ic rebuild", "reason.path.refmt":"bash - ic refmt", "reason.path.refmterr":"bash - ic refmterr", "reason.path.rtop":"bash - ic rtop", "editor.formatOnSave": true, "reason.diagnostics.tools":["merlin","bsb"], "terminal.integrated.shell.windows":"C:\\\\WINDOWS\\\\System32\\\\bash.exe" After the initial install command has terminated, you can now open WSL (Ubuntu).
    [Show full text]
  • Iroha Handbook: Installation, Getting Started, API, Guides, and Troubleshooting
    Iroha handbook: installation, getting started, API, guides, and troubleshooting Hyperledger Iroha community Aug 24, 2021 TABLE OF CONTENTS 1 Overview of Iroha 3 1.1 What are the key features of Iroha?...................................3 1.2 Where can Iroha be used?........................................3 1.3 How is it different from Bitcoin or Ethereum?..............................3 1.4 How is it different from the rest of Hyperledger frameworks or other permissioned blockchains?...4 1.5 How to create applications around Iroha?................................4 2 Concepts and Architecture 5 2.1 Core concepts..............................................5 2.2 What’s inside Iroha?........................................... 13 3 Quick Start Guide 17 3.1 Prerequisites............................................... 17 3.2 Starting Iroha Node........................................... 17 3.3 Try other guides............................................. 19 4 Integrated Projects 29 4.1 Hyperledger Ursa............................................. 29 4.2 Hyperledger Explorer.......................................... 29 4.3 Hyperledger Burrow........................................... 30 5 Building Iroha 37 5.1 Prerequisites............................................... 37 5.2 Installing dependencies with Vcpkg Dependency Manager....................... 39 5.3 Build Process............................................... 40 6 Configure 45 6.1 Configure TLS for client-peer communication (torii).......................... 45 6.2 Deployment-specific
    [Show full text]
  • Manual De Iroha: Instalaci´On,Inicio, API, Gu´Iasy Resoluci´Onde Problemas Выпуск
    Manual de Iroha: instalaci´on,inicio, API, gu´ıasy resoluci´onde problemas Выпуск Comunidad Iroha Hyperledger янв. 26, 2021 Содержание 1 Overview of Iroha 3 1.1 What are the key features of Iroha?................................3 1.2 Where can Iroha be used?......................................3 1.3 How is it different from Bitcoin or Ethereum?..........................3 1.4 How is it different from the rest of Hyperledger frameworks or other permissioned blockchains?4 1.5 How to create applications around Iroha?.............................4 2 С чего начать 5 2.1 Prerequisites.............................................5 2.2 Starting Iroha Node.........................................5 2.3 Try other guides...........................................7 3 Use Case Scenarios 9 3.1 Certificates in Education, Healthcare...............................9 3.2 Cross-Border Asset Transfers.................................... 10 3.3 Financial Applications........................................ 10 3.4 Identity Management........................................ 11 3.5 Supply Chain............................................. 11 3.6 Fund Management.......................................... 12 3.7 Related Research........................................... 12 4 Ключевые концепции 13 4.1 Sections................................................ 13 5 Guides and how-tos 23 5.1 Building Iroha............................................ 23 5.2 Конфигурация........................................... 29 5.3 Deploying Iroha..........................................
    [Show full text]
  • Declare Module Typescript Library
    Declare Module Typescript Library Mahmud quintuplicate fantastically as untenantable Glynn grabbles her jays clot tribally. Measlier and noisier Matthias always scunges enlargedly and tessellating his mitzvahs. Undebauched Gunter enisled: he fledging his padauks philosophically and yore. Roughly speaking, how exactly do we make use of these declaration files in our code base? Not every component fully supports any component type you pass in. The compiler will accept JSX. Component Library is like any other NPM Module. Sometimes, I am exporting it to maintain symmetry with the other files. The types here are fine but they do not truly convey the meaning or intent of the code. Passing CLI arguments via shebang is allowed on Mac but not Linux. But they work differently. Software engineer taught me that a Startup product grows and develops every day. In this article, we are going to learn the structure of the Type Declaration files and their use cases. Mozilla and individual contributors. Now, this means something is wrong with the way PHPStorm interprets tsconfig. Typescript will then also export type definitions together with the compiled javascript code so the package can be used with both Typescript and Javascript. Either choice will solve your error. Dan is a big geek who likes making stuff with computers! Senior Front End Engineer at Modus Create. An introduction to TypeScript's module system techscouting. Plus, this should be true. How do I use it? Now that we have everything set up, etc. Once you have the clone URL, the Redux pattern is a radical departure from the style of programming we are used to.
    [Show full text]
  • Npm Packages As Ingredients: a Recipe-Based Approach
    npm Packages as Ingredients: a Recipe-based Approach Kyriakos C. Chatzidimitriou, Michail D. Papamichail, Themistoklis Diamantopoulos, Napoleon-Christos Oikonomou, and Andreas L. Symeonidis Electrical and Computer Engineering Dept., Aristotle University of Thessaloniki, Thessaloniki, Greece fkyrcha, mpapamic, thdiaman, [email protected], [email protected] Keywords: Dependency Networks, Software Reuse, JavaScript, npm, node. Abstract: The sharing and growth of open source software packages in the npm JavaScript (JS) ecosystem has been exponential, not only in numbers but also in terms of interconnectivity, to the extend that often the size of de- pendencies has become more than the size of the written code. This reuse-oriented paradigm, often attributed to the lack of a standard library in node and/or in the micropackaging culture of the ecosystem, yields interest- ing insights on the way developers build their packages. In this work we view the dependency network of the npm ecosystem from a “culinary” perspective. We assume that dependencies are the ingredients in a recipe, which corresponds to the produced software package. We employ network analysis and information retrieval techniques in order to capture the dependencies that tend to co-occur in the development of npm packages and identify the communities that have been evolved as the main drivers for npm’s exponential growth. 1 INTRODUCTION Given that dependencies and reusability have be- come very important in today’s software develop- The popularity of JS is constantly increasing, and ment process, npm registry has become a “must” along is increasing the popularity of frameworks for place for developers to share packages, defining code building server (e.g.
    [Show full text]
  • Enhancement of a Vulnerability Checker for Software Libraries with Similarity Metrics Based on File-Hashes
    Gottfried Wilhelm Leibniz Universität Hannover Faculty of Electrical Engineering and Computer Science Institute of Practical Computer Science Software Engineering Group Enhancement of a Vulnerability Checker for Software Libraries with Similarity Metrics based on File-Hashes Bachelor Thesis in Computer Science by Huu Kim Nguyen First Examiner: Prof. Dr. Kurt Schneider Second Examiner: Dr. Jil Klünder Supervisor: M.Sc. Fabien Patrick Viertel Hannover, March 19, 2020 ii Declaration of Independence I hereby certify that I have written the present bachelor thesis independently and without outside help and that I have not used any sources and aids other than those specified in the work. The work has not yet been submitted to any other examination office in the same or similar form. Hannover, March 19, 2020 _____________________________________ Huu Kim Nguyen iii iv Abstract This bachelor thesis presents a software which checks a software project for libraries that have security vulnerabilities so the user is notified to update them. External software libraries and frameworks are used in websites and other software to provide new functionality. Using outdated and vulnerable libraries poses a large risk to developers and users. Finding vulnerabilities should be part of the software development. Manually finding vulnerable libraries is a time consuming process. The solution presented in this thesis is a vulnerability checker which scans the project library for any libraries that contain security vulnerabilities provided that the software project is written in Java or in JavaScript. It uses hash signatures obtained from these libraries to check against a database that has hash signatures of libraries that are known to have security vulnerabilities.
    [Show full text]
  • A Package Manager for Curry
    A Package Manager for Curry Jonas Oberschweiber Master-Thesis eingereicht im September 2016 Christian-Albrechts-Universität zu Kiel Programmiersprachen und Übersetzerkonstruktion Betreut durch: Prof. Dr. Michael Hanus und M.Sc. Björn Peemöller Eidesstattliche Erklärung Hiermit erkläre ich an Eides statt, dass ich die vorliegende Arbeit selbstständig ver- fasst und keine anderen als die angegebenen Quellen und Hilfsmittel verwendet habe. Kiel, Contents 1 Introduction 1 2 The Curry Programming Language 3 2.1 Curry’s Logic Features 3 2.2 Abstract Curry 5 2.3 The Compiler Ecosystem 6 3 Package Management Systems 9 3.1 Semantic Versioning 10 3.2 Dependency Management 12 3.3 Ruby’s Gems and Bundler 16 3.4 JavaScript’s npm 19 3.5 Haskell’s Cabal 21 4 A Package Manager for Curry 25 4.1 The Command Line Interface 26 4.2 What’s in a Package? 29 4.3 Finding Packages 35 4.4 Installing Packages 37 4.5 Resolving Dependencies 38 vi A Package Manager for Curry 4.6 Interacting with the Compiler 43 4.7 Enforcing Semantic Versioning 46 5 Implementation 51 5.1 The Main Module 52 5.2 Packages and Dependencies 56 5.3 Dependency Resolution 58 5.4 Comparing APIs 71 5.5 Comparing Program Behavior 73 6 Evaluation 85 6.1 Comparing Package Versions 85 6.2 A Sample Dependency Resolution 88 6.3 Performance of the Resolution Algorithm 90 6.4 Performance of API and Behavior Comparison 96 7 Summary & Future Work 99 A Total Order on Versions 105 B A Few Curry Packages 109 C Raw Performance Figures 117 D User’s Manual 121 1 Introduction Modern software systems typically rely on many external libraries, reusing func- tionality that can be shared between programs instead of reimplementing it for each new project.
    [Show full text]
  • Investigating the Reproducbility of NPM Packages
    Investigating the Reproducbility of NPM packages Pronnoy Goswami Thesis submitted to the Faculty of the Virginia Polytechnic Institute and State University in partial fulfillment of the requirements for the degree of Master of Science in Computer Engineering Haibo Zeng, Chair Na Meng Paul E. Plassmann May 6, 2020 Blacksburg, Virginia Keywords: Empirical, JavaScript, NPM packages, Reproducibility, Software Security, Software Engineering Copyright 2020, Pronnoy Goswami Investigating the Reproducbility of NPM packages Pronnoy Goswami (ABSTRACT) The meteoric increase in the popularity of JavaScript and a large developer community has led to the emergence of a large ecosystem of third-party packages available via the Node Package Manager (NPM) repository which contains over one million published packages and witnesses a billion daily downloads. Most of the developers download these pre-compiled published packages from the NPM repository instead of building these packages from the available source code. Unfortunately, recent articles have revealed repackaging attacks to the NPM packages. To achieve such attacks the attackers primarily follow three steps – (1) download the source code of a highly depended upon NPM package, (2) inject mali- cious code, and (3) then publish the modified packages as either misnamed package (i.e., typo-squatting attack) or as the official package on the NPM repository using compromised maintainer credentials. These attacks highlight the need to verify the reproducibility of NPM packages. Reproducible Build is a concept that allows the verification of build artifacts for pre-compiled packages by re-building the packages using the same build environment config- uration documented by the package maintainers. This motivates us to conduct an empirical study (1) to examine the reproducibility of NPM packages, (2) to assess the influence of any non-reproducible packages, and (3) to explore the reasons for non-reproducibility.
    [Show full text]