On the public citation graph
Why do developers use trivial packages? an empirical case study on npm
0 signed · 181 inferred · view as graph
Inferred edges come from two machine sources: sweeps of open repository metadata (mostly SSRN and Zenodo), and a bulk OpenAlex citation snapshot. Every row below is labelled with the one it came from. Neither is a complete citation index — absence here is not evidence of absence.
Is this your work? Sign in with ORCID and put your name on the
claims that are yours.
Reference health. See whether every reference in this work resolves to a
known work and none has been retracted — and get a dated CiteStamped
badge you can embed.
What this work says
Outgoing claims: the papers this work cites, builds on, or argues with.
inferredcites →https://doi.org/10.1007/978-0-387-09684-1_13openalex-snapshot
Update Propagation Practices in Highly Reusable Open Source Components
inferredcites →https://doi.org/10.1007/978-1-84800-044-5openalex-snapshot
Guide to Advanced Empirical Software Engineering
inferredcites →https://doi.org/10.1007/978-1-84800-044-5_1openalex-snapshot
Software Engineering Data Collection for Field Studies
inferredcites →https://doi.org/10.1007/978-3-642-21544-5_5openalex-snapshot
Steering Insight: An Exploration of the Ruby Software Ecosystem
inferredcites →https://doi.org/10.1016/j.infsof.2017.04.005openalex-snapshot
On code reuse from StackOverflow: An exploratory study on Android apps
inferredcites →https://doi.org/10.1016/j.jss.2016.02.003openalex-snapshot
Revisiting software ecosystems Research: A longitudinal literature study
inferredcites →https://doi.org/10.1016/j.scico.2010.11.001openalex-snapshot
Supporting software evolution in component-based FOSS systems
inferredcites →https://doi.org/10.1109/52.311048openalex-snapshot
Effects of reuse on quality, productivity, and economics
inferredcites →https://doi.org/10.1109/asew.2015.21openalex-snapshot
When It Breaks, It Breaks: How Ecosystem Developers Reason about the Stability of Dependencies
inferredcites →https://doi.org/10.1109/csmr.2013.1openalex-snapshot
Proceedings of the 2013 17th European Conference on Software Maintenance and Reengineering (CSMR 2013)
inferredcites →https://doi.org/10.1109/csmr.2013.33openalex-snapshot
The Evolution of the R Software Ecosystem
inferredcites →https://doi.org/10.1109/esem.2009.5316017openalex-snapshot
Strong dependencies between software components
inferredcites →https://doi.org/10.1109/floss.2007.10openalex-snapshot
Large-Scale Code Reuse in Open Source Software
inferredcites →https://doi.org/10.1109/icse.2012.6227181openalex-snapshot
Where does this code come from and where does it go? — Integrated code history tracker for open source systems
inferredcites →https://doi.org/10.1109/icsm.2013.39openalex-snapshot
The Evolution of Project Inter-dependencies in a Software Ecosystem: The Case of Apache
inferredcites →https://doi.org/10.1109/saner.2016.12openalex-snapshot
When GitHub Meets CRAN: An Analysis of Inter-Repository Package Dependency Problems
inferredcites →https://doi.org/10.1109/saner.2017.7884604openalex-snapshot
An empirical comparison of dependency issues in OSS packaging ecosystems
inferredcites →https://doi.org/10.1145/1368088.1368122openalex-snapshot
An empirical study of software developers' management of dependencies and changes
inferredcites →https://doi.org/10.1145/236156.236184openalex-snapshot
How reuse influences productivity in object-oriented systems
inferredcites →https://doi.org/10.1145/2568225.2568315openalex-snapshot
Influence of social and technical factors for evaluating contribution in GitHub
inferredcites →https://doi.org/10.1145/2597073.2597074openalex-snapshot
The promises and perils of mining GitHub
inferredcites →https://doi.org/10.1145/2597073.2597122openalex-snapshot
A dataset for pull-based development research
inferredcites →https://doi.org/10.1145/2597073.2597131openalex-snapshot
Gentoo package dependencies over time
inferredcites →https://doi.org/10.1145/2901739.2901743openalex-snapshot
A look at the dynamics of the JavaScript package ecosystem
inferredcites →https://doi.org/10.1145/2950290.2950308openalex-snapshot
Discovering bug patterns in JavaScript
inferredcites →https://doi.org/10.1145/2950290.2950325openalex-snapshot
How to break an API: cost negotiation and community values in three software ecosystems
inferredcites →https://doi.org/10.1145/2993412.3003382openalex-snapshot
On the topology of package dependency networks
inferredcites →https://doi.org/10.1145/940071.940110openalex-snapshot
Predicting problems caused by component upgrades
inferredcites →https://doi.org/10.1177/001316446002000104openalex-snapshot
A Coefficient of Agreement for Nominal Scales
inferredcites →https://doi.org/10.1177/001316447303300309openalex-snapshot
The Equivalence of Weighted Kappa and the Intraclass Correlation Coefficient as Measures of Reliability
inferredcites →https://doi.org/10.1177/1077800405284363openalex-snapshot
Five Misunderstandings About Case-Study Research
inferredcites →https://doi.org/10.1287/mnsc.1070.0748openalex-snapshot
Code Reuse in Open Source Software
inferredcites →https://doi.org/10.17705/1jais.00248openalex-snapshot
Code Reuse in Open Source Software Development: Quantitative Evidence, Drivers, and Impediments
What points at this work
Incoming claims: where this work appears in other papers’ reference lists and arguments.
inferred← citeshttps://doi.org/10.2139/ssrn.4070797openalex-extracted
What are the Characteristics of Highly-Selected Packages? A Case Study on the NPM Ecosystem
inferred← citeshttps://doi.org/10.2139/ssrn.4082606openalex-extracted
A Machine Learning Approach to Determine the Semantic Versioning Type of NPM Packages Releases
inferred← citeshttps://doi.org/10.5281/zenodo.4701497openalex-extracted
Dependency Smells in JavaScript Projects
inferred← citeshttps://doi.org/10.1002/smr.2157openalex-snapshot
A formal framework for measuring technical lag in component repositories — and its application to npm
inferred← citeshttps://doi.org/10.1002/smr.2267openalex-snapshot
An empirical analysis of source code metrics and smart contract resource consumption
inferred← citeshttps://doi.org/10.1002/smr.70159openalex-snapshot
Security Assessment of Private Package Repositories: An Experience on Acc‐Py at CERN
inferred← citeshttps://doi.org/10.1007/978-3-030-87839-9_6openalex-snapshot
A Survey on Common Threats in npm and PyPi Registries
inferred← citeshttps://doi.org/10.1007/978-3-030-89051-3_5openalex-snapshot
Server-Side Computation of Package Dependencies in Package-Management Systems
inferred← citeshttps://doi.org/10.1007/978-3-031-09917-5_33openalex-snapshot
Enhance Web-Components in Order to Increase Security and Maintainability
inferred← citeshttps://doi.org/10.1007/978-3-031-36060-2_1openalex-snapshot
An Introduction to Software Ecosystems
inferred← citeshttps://doi.org/10.1007/978-3-031-66326-0_22openalex-snapshot
Studying the Evolution of Library Utilization in Maven Projects: A Metric-Based Approach
inferred← citeshttps://doi.org/10.1007/978-3-031-82610-8_4openalex-snapshot
A Preliminary Study on Self-contained Libraries in the NPM Ecosystem
inferred← citeshttps://doi.org/10.1007/978-3-032-08649-5_9openalex-snapshot
Structural and Connectivity Patterns in the Maven Central Software Dependency Network
inferred← citeshttps://doi.org/10.1007/978-3-032-12089-2_41openalex-snapshot
Detecting and Characterizing Low and No Functionality Packages in the NPM Ecosystem
inferred← citeshttps://doi.org/10.1007/978-3-319-90421-4_6openalex-snapshot
An Empirical Analysis of Technical Lag in npm Package Dependencies
inferred← citeshttps://doi.org/10.1007/978-981-13-7099-1_6openalex-snapshot
The Life and Death of Software Ecosystems
inferred← citeshttps://doi.org/10.1007/978-981-96-1797-5_2openalex-snapshot
Modeling Software Supply Chains and Analyzing Their Evolutionary Behaviors
inferred← citeshttps://doi.org/10.1007/978-981-96-1797-5_7openalex-snapshot
Exploring Cross Ecosystem Vulnerability Impacts
inferred← citeshttps://doi.org/10.1007/978-981-96-1797-5_8openalex-snapshot
Boosting the Propagation of Vulnerability Fixes in the npm Ecosystem
inferred← citeshttps://doi.org/10.1007/s10515-025-00540-6openalex-snapshot
Automated detection of affected libraries from vulnerability reports
inferred← citeshttps://doi.org/10.1007/s10664-017-9589-yopenalex-snapshot
An empirical comparison of dependency network evolution in seven software packaging ecosystems
inferred← citeshttps://doi.org/10.1007/s10664-019-09771-0openalex-snapshot
Why reinventing the wheels? An empirical study on library reuse and re-implementation
inferred← citeshttps://doi.org/10.1007/s10664-019-09791-wopenalex-snapshot
Deriving a usage-independent software quality metric
inferred← citeshttps://doi.org/10.1007/s10664-019-09792-9openalex-snapshot
On the impact of using trivial packages: an empirical case study on npm and PyPI
inferred← citeshttps://doi.org/10.1007/s10664-020-09904-wopenalex-snapshot
Helping or not helping? Why and how trivial packages impact the npm ecosystem
inferred← citeshttps://doi.org/10.1007/s10664-020-09936-2openalex-snapshot
From one to hundreds: multi-licensing in the JavaScript ecosystem
inferred← citeshttps://doi.org/10.1007/s10664-021-09951-xopenalex-snapshot
Lags in the release, adoption, and propagation of npm vulnerability fixes
inferred← citeshttps://doi.org/10.1007/s10664-021-09959-3openalex-snapshot
Out of sight, out of mind? How vulnerable dependencies affect open-source projects
inferred← citeshttps://doi.org/10.1007/s10664-021-10071-9openalex-snapshot
Präzi: from package-based to call-based dependency networks
inferred← citeshttps://doi.org/10.1007/s10664-022-10131-8openalex-snapshot
Characterizing usages, updates and risks of third-party libraries in Java projects
inferred← citeshttps://doi.org/10.1007/s10664-022-10241-3openalex-snapshot
Selecting third-party libraries: the data scientist’s perspective
inferred← citeshttps://doi.org/10.1007/s10664-022-10278-4openalex-snapshot
Empirical analysis of security vulnerabilities in Python packages
inferred← citeshttps://doi.org/10.1007/s10664-023-10315-wopenalex-snapshot
Understanding the role of external pull requests in the NPM ecosystem
inferred← citeshttps://doi.org/10.1007/s10664-023-10366-zopenalex-snapshot
When conversations turn into work: a taxonomy of converted discussions and issues in GitHub
inferred← citeshttps://doi.org/10.1007/s10664-023-10399-4openalex-snapshot
Unreproducible builds: time to fix, causes, and correlation with external ecosystem factors
inferred← citeshttps://doi.org/10.1007/s10664-025-10648-8openalex-snapshot
Opportunities and security risks of technical leverage: A replication study on the NPM ecosystem
inferred← citeshttps://doi.org/10.1007/s10664-025-10711-4openalex-snapshot
“I see models being a whole other thing”: an empirical study of pre-trained model naming conventions and a tool for enhancing naming consistency
inferred← citeshttps://doi.org/10.1007/s10664-025-10753-8openalex-snapshot
A Comprehensive Study of the Lifecycle of Dormant npm Packages
inferred← citeshttps://doi.org/10.1007/s10664-026-10873-9openalex-snapshot
A methodology to perform cross-ecosystems case-control security studies
inferred← citeshttps://doi.org/10.1016/j.infsof.2020.106365openalex-snapshot
Simplifying the Search of npm Packages
inferred← citeshttps://doi.org/10.1016/j.jss.2021.111134openalex-snapshot
API beauty is in the eye of the clients: 2.2 million Maven dependencies reveal the spectrum of client–API usages
inferred← citeshttps://doi.org/10.1016/j.jss.2023.111827openalex-snapshot
On the outdatedness of workflows in the GitHub Actions ecosystem
inferred← citeshttps://doi.org/10.1016/j.jss.2025.112509openalex-snapshot
Detecting and removing bloated dependencies in CommonJS packages
inferred← citeshttps://doi.org/10.1109/access.2025.3573515openalex-snapshot
Comprehensive Analysis and Recommendation of Supply Chain Risk Management Framework for the Military Domain
inferred← citeshttps://doi.org/10.1109/ase.2017.8115621openalex-snapshot
Can automated pull requests encourage software developers to upgrade out-of-date dependencies?
inferred← citeshttps://doi.org/10.1109/ase.2019.00048openalex-snapshot
Testing Regex Generalizability And Its Implications: A Large-Scale Many-Language Measurement Study
inferred← citeshttps://doi.org/10.1109/ase56229.2023.00119openalex-snapshot
Where to Go Now? Finding Alternatives for Declining Packages in the npm Ecosystem
inferred← citeshttps://doi.org/10.1109/fit47737.2019.00051openalex-snapshot
Security Against Compromised Servers: Verifiable DB Queries
inferred← citeshttps://doi.org/10.1109/icse-companion55297.2022.9793802openalex-snapshot
To Disengage or Not to Disengage: A Look at Contributor Disengagement in Open Source Software
inferred← citeshttps://doi.org/10.1109/icse-nier.2019.00022openalex-snapshot
Blockchain-Based Software Engineering
inferred← citeshttps://doi.org/10.1109/icse-seip55303.2022.9793945openalex-snapshot
Strategies for Reuse and Sharing among Data Scientists in Software Teams
inferred← citeshttps://doi.org/10.1109/icse.2019.00064openalex-snapshot
On Reliability of Patch Correctness Assessment
inferred← citeshttps://doi.org/10.1109/icse43902.2021.00093openalex-snapshot
What Makes a Great Maintainer of Open Source Projects?
inferred← citeshttps://doi.org/10.1109/icse43902.2021.00121openalex-snapshot
Containing Malicious Package Updates in npm with a Lightweight Permission System
inferred← citeshttps://doi.org/10.1109/icse48619.2023.00096openalex-snapshot
SecBench.js: An Executable Security Benchmark Suite for Server-Side JavaScript
inferred← citeshttps://doi.org/10.1109/icse48619.2023.00206openalex-snapshot
An Empirical Study of Pre-Trained Model Reuse in the Hugging Face Deep Learning Model Registry
inferred← citeshttps://doi.org/10.1109/icse55347.2025.00054openalex-snapshot
Understanding and Detecting Peer Dependency Resolving Loop in npm Ecosystem
inferred← citeshttps://doi.org/10.1109/icsme46990.2020.00014openalex-snapshot
An Empirical Study of Usages, Updates and Risks of Third-Party Libraries in Java Projects
inferred← citeshttps://doi.org/10.1109/icsme58944.2024.00016openalex-snapshot
Maven Unzipped: Exploring the Impact of Library Packaging on the Ecosystem
inferred← citeshttps://doi.org/10.1109/jva60410.2023.00015openalex-snapshot
Reusing Deep Learning Models: Challenges and Directions in Software Engineering
inferred← citeshttps://doi.org/10.1109/msr.2019.00059openalex-snapshot
The Emergence of Software Diversity in Maven Central
inferred← citeshttps://doi.org/10.1109/msr52588.2021.00037openalex-snapshot
On the Use of Dependabot Security Pull Requests
inferred← citeshttps://doi.org/10.1109/msr59073.2023.00073openalex-snapshot
A Large Scale Analysis of Semantic Versioning in NPM
inferred← citeshttps://doi.org/10.1109/msr66628.2025.00055openalex-snapshot
Dependency Dilemmas: A Comparative Study of Independent and Dependent Artifacts in Maven Central Ecosystem
inferred← citeshttps://doi.org/10.1109/saner.2018.8330217openalex-snapshot
A generalized model for visualizing library popularity, adoption, and diffusion within a software ecosystem
inferred← citeshttps://doi.org/10.1109/saner56733.2023.00031openalex-snapshot
In-Situ Concolic Testing of JavaScript
inferred← citeshttps://doi.org/10.1109/saner56733.2023.00055openalex-snapshot
How Dynamic Features Affect API Usages? An Empirical Study of API Misuses in Python Programs
inferred← citeshttps://doi.org/10.1109/saner56733.2023.00064openalex-snapshot
Self-Admitted Library Migrations in Java, JavaScript, and Python Packaging Ecosystems: A Comparative Study
inferred← citeshttps://doi.org/10.1109/secdev61143.2024.00017openalex-snapshot
GENIE: Guarding the npm Ecosystem with Semantic Malware Detection
inferred← citeshttps://doi.org/10.1109/sera61261.2024.10685609openalex-snapshot
Contributing Back to the Ecosystem: A User Survey of NPM Developers
inferred← citeshttps://doi.org/10.1109/sp46215.2023.10179378openalex-snapshot
"Always Contribute Back": A Qualitative Study on Security Challenges of the Open Source Supply Chain
inferred← citeshttps://doi.org/10.1109/sp63933.2026.00115openalex-snapshot
Best of Both Worlds: Effective Foreign Bridge Identification in V8 Embedders for Security Analysis
inferred← citeshttps://doi.org/10.1109/tem.2021.3122012openalex-snapshot
Toward Using Package Centrality Trend to Identify Packages in Decline
inferred← citeshttps://doi.org/10.1109/tnse.2023.3260880openalex-snapshot
Vulnerability of Package Dependency Networks
inferred← citeshttps://doi.org/10.1109/tr.2023.3286301openalex-snapshot
Study of JavaScript Static Analysis Tools for Vulnerability Detection in Node.js Packages
inferred← citeshttps://doi.org/10.1109/tr.2026.3676895openalex-snapshot
Snake in the Grass: A Hybrid Detection Method Targeting Malicious PyPI Packages
inferred← citeshttps://doi.org/10.1109/tse.2017.2782280openalex-snapshot
An Empirical Study on API Usages
inferred← citeshttps://doi.org/10.1109/tse.2019.2952130openalex-snapshot
An Empirical Study of Dependency Downgrades in the npm Ecosystem
inferred← citeshttps://doi.org/10.1109/tse.2021.3068901openalex-snapshot
On the Untriviality of Trivial Packages: An Empirical Study of npm JavaScript Packages
inferred← citeshttps://doi.org/10.1109/tse.2021.3106247openalex-snapshot
Dependency Smells in JavaScript Projects
inferred← citeshttps://doi.org/10.1109/tse.2022.3225197openalex-snapshot
Giving Back: Contributions Congruent to Library Dependency Changes in a Software Ecosystem
inferred← citeshttps://doi.org/10.1109/tse.2023.3243262openalex-snapshot
Plumber: Boosting the Propagation of Vulnerability Fixes in the npm Ecosystem
inferred← citeshttps://doi.org/10.1109/tse.2023.3248113openalex-snapshot
NCQ: Code Reuse Support for Node.js Developers
inferred← citeshttps://doi.org/10.1109/tse.2026.3660015openalex-snapshot
A Deep Dive Into Deprecation Declarations in the Rust Package Ecosystem
inferred← citeshttps://doi.org/10.1109/vissoft55257.2022.00027openalex-snapshot
VizAPI: Visualizing Interactions between Java Libraries and Clients
inferred← citeshttps://doi.org/10.1142/s0218194022500498openalex-snapshot
A Semantic Web-Enabled Approach for Dependency Management
inferred← citeshttps://doi.org/10.1142/s0218194024500402openalex-snapshot
Selecting Third-Party Libraries: The Web Developers’ Perspective
inferred← citeshttps://doi.org/10.1145/3106237.3121278openalex-snapshot
Reasons and drawbacks of using trivial npm packages: the developers' perspective
inferred← citeshttps://doi.org/10.1145/3180155.3180209openalex-snapshot
Adding sparkle to social coding
inferred← citeshttps://doi.org/10.1145/3194124.3194129openalex-snapshot
Maintaining third-party libraries through domain-specific category recommendations
inferred← citeshttps://doi.org/10.1145/3196398.3196401openalex-snapshot
On the impact of security vulnerabilities in the npm package dependency network
inferred← citeshttps://doi.org/10.1145/3236024.3236027openalex-snapshot
The impact of regular expression denial of service (ReDoS) in practice: an empirical study at the ecosystem scale
inferred← citeshttps://doi.org/10.1145/3236024.3236062openalex-snapshot
Ecosystem-level determinants of sustained activity in open-source projects: a case study of the PyPI ecosystem
inferred← citeshttps://doi.org/10.1145/3236024.3275526openalex-snapshot
Software development challenges with air-gap isolation
inferred← citeshttps://doi.org/10.1145/3273934.3273942openalex-snapshot
Are Software Dependency Supply Chain Metrics Useful in Predicting Change of Popularity of NPM Packages?
inferred← citeshttps://doi.org/10.1145/3359591.3359732openalex-snapshot
Active learning for software engineering
inferred← citeshttps://doi.org/10.1145/3368089.3409689openalex-snapshot
Interactive, effort-aware library version harmonization
inferred← citeshttps://doi.org/10.1145/3368089.3409711openalex-snapshot
Selecting third-party libraries: the practitioners’ perspective
inferred← citeshttps://doi.org/10.1145/3377811.3380922openalex-snapshot
An empirical study on API parameter rules
inferred← citeshttps://doi.org/10.1145/3379597.3387476openalex-snapshot
Using Others' Tests to Identify Breaking Updates
inferred← citeshttps://doi.org/10.1145/3387940.3392206openalex-snapshot
Towards A Dependency-Driven Taxonomy of Software Types
inferred← citeshttps://doi.org/10.1145/3387940.3392209openalex-snapshot
A first look at an emerging model of community organizations for the long-term maintenance of ecosystems' packages
inferred← citeshttps://doi.org/10.1145/3510003.3510142openalex-snapshot
Demystifying the vulnerability propagation and its evolution via dependency trees in the NPM ecosystem
inferred← citeshttps://doi.org/10.1145/3510454.3522685openalex-snapshot
To disengage or not to disengage
inferred← citeshttps://doi.org/10.1145/3510457.3513042openalex-snapshot
Strategies for reuse and sharing among data scientists in software teams
inferred← citeshttps://doi.org/10.1145/3522587openalex-snapshot
There’s no Such Thing as a Free Lunch: Lessons Learned from Exploring the Overhead Introduced by the Greenkeeper Dependency Bot in Npm
inferred← citeshttps://doi.org/10.1145/3526113.3545647openalex-snapshot
Concept-Annotated Examples for Library Comparison
inferred← citeshttps://doi.org/10.1145/3551349.3556896openalex-snapshot
Not All Dependencies are Equal: An Empirical Study on Production Dependencies in NPM
inferred← citeshttps://doi.org/10.1145/3551349.3556921openalex-snapshot
Insight: Exploring Cross-Ecosystem Vulnerability Impacts
inferred← citeshttps://doi.org/10.1145/3576915.3623140openalex-snapshot
Jack-in-the-box: An Empirical Study of JavaScript Bundling on the Web and its Security Implications
inferred← citeshttps://doi.org/10.1145/3589608.3594742openalex-snapshot
Sidecar-based Path-aware Security for Microservices
inferred← citeshttps://doi.org/10.1145/3605770.3625216openalex-snapshot
(Nothing But) Many Eyes Make All Bugs Shallow
inferred← citeshttps://doi.org/10.1145/3643731openalex-snapshot
Characterizing Python Library Migrations
inferred← citeshttps://doi.org/10.1145/3643764openalex-snapshot
AROMA: Automatic Reproduction of Maven Artifacts
inferred← citeshttps://doi.org/10.1145/3643991.3644879openalex-snapshot
Goblin: A Framework for Enriching and Querying the Maven Central Dependency Graph
inferred← citeshttps://doi.org/10.1145/3650212.3680370openalex-snapshot
Inconsistencies in TeX-Produced Documents
inferred← citeshttps://doi.org/10.1145/3656394openalex-snapshot
Efficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs
inferred← citeshttps://doi.org/10.1145/3661167.3661279openalex-snapshot
An Empirical Investigation of the Security Weaknesses in Open-Source Projects
inferred← citeshttps://doi.org/10.1145/3674805.3686665openalex-snapshot
What do we know about Hugging Face? A systematic literature review and quantitative validation of qualitative claims
inferred← citeshttps://doi.org/10.1145/3688842openalex-snapshot
My Fuzzers Won’t Build: An Empirical Study of Fuzzing Build Failures
inferred← citeshttps://doi.org/10.1145/3689944.3696160openalex-snapshot
Developers' Approaches to Software Supply Chain Security: An Interview Study
inferred← citeshttps://doi.org/10.1145/3702991openalex-snapshot
Toward Better Comprehension of Breaking Changes in the NPM Ecosystem
inferred← citeshttps://doi.org/10.1145/3715728openalex-snapshot
Pinning Is Futile: You Need More Than Local Dependency Versioning to Defend against Supply Chain Attacks
inferred← citeshttps://doi.org/10.1145/3729381openalex-snapshot
On the Characteristics and Impacts of Protestware Libraries
inferred← citeshttps://doi.org/10.1145/3733827.3765527openalex-snapshot
Spilling the Tea: Uncovering TEA Token Abuse in npm
inferred← citeshttps://doi.org/10.1145/3733827.3765528openalex-snapshot
Aggregating Security Measures from the Dependency Tree
inferred← citeshttps://doi.org/10.1145/3770855.3818652openalex-snapshot
Recipes for Agents: Understanding Skills and Their Open Questions
inferred← citeshttps://doi.org/10.1145/3816022openalex-snapshot
Analyzing C/C++ Library Migrations at the Package-level: Prevalence, Domains, Targets and Rationales across Seven Package Management Tools
inferred← citeshttps://doi.org/10.1145/3832180openalex-snapshot
Deprecated but Not Abandoned: A Large-Scale Empirical Study on Growing-User-Demand Deprecated NPM Packages
inferred← citeshttps://doi.org/10.1177/26339137241231912openalex-snapshot
Modeling interconnected social and technical risks in open source software ecosystems
inferred← citeshttps://doi.org/10.14722/ndss.2024.24073openalex-snapshot
UntrustIDE: Exploiting Weaknesses in VS Code Extensions
inferred← citeshttps://doi.org/10.15368/theses.2021.34openalex-snapshot
DependencyVis: Helping Developers Visualize Software Dependency Information
inferred← citeshttps://doi.org/10.1587/transinf.2025mpp0001openalex-snapshot
Should Maintainers Deploy to Cross-Ecosystems? An Analysis of Packages from PyPI and NPM
inferred← citeshttps://doi.org/10.21203/rs.3.rs-2560509/v1openalex-snapshot
An Empirical Study of npm Ecosystem Related Tweets by Core Software Developers: A Case Study
inferred← citeshttps://doi.org/10.21203/rs.3.rs-3369458/v1openalex-snapshot
A Machine Learning Approach to Determine the Semantic Versioning Type of npm Packages Releases
inferred← citeshttps://doi.org/10.22028/d291-47505openalex-snapshot
Bilingual Problems: Studying the Security Risks Incurred by Native Extensions in Scripting Languages
inferred← citeshttps://doi.org/10.32628/ijsrst24115104openalex-snapshot
A Review of Protection Mechanisms and Examination of Security and Access Control Measures in Java Packages
inferred← citeshttps://doi.org/10.5220/0007966805440551openalex-snapshot
npm Packages as Ingredients: A Recipe-based Approach
inferred← citeshttps://doi.org/10.5281/zenodo.4471361openalex-snapshot
Präzi: From Package-based to Call-based Dependency Networks
inferred← citeshttps://doi.org/10.5753/sbsi.2026.248708openalex-snapshot
An Analysis of Software Vulnerabilities and Weaknesses in Machine Learning Libraries
inferred← citeshttps://doi.org/10.70675/23c6195ezb6f6z4a7dza15ez7c317c646756openalex-snapshot
Analysis and evolution of dependencies in software ecosystems
inferred← citeshttps://doi.org/10.70675/7d8a27b4zebf6z43c3z9577zeaa9e6c64d97openalex-snapshot
Challenges in the collaborative evolution of a proof language and its ecosystem
inferred← citeshttps://doi.org/10.7717/peerj-cs.1669openalex-snapshot
An empirical study of software ecosystem related tweets by npm maintainers
Editorial review for independent work. ICSAC — the Institute for Complexity
Science and Advanced Computing — runs a structured editorial panel for researchers
publishing outside journals, and publishes on CiteStamp rails. Submission is free
and goes through ORCID: icsacinstitute.org/submit.