Breaking the borders: an investigation of cross-ecosystem software packages

TL;DR

This paper investigates cross-ecosystem software packages, revealing their distribution, characteristics, and impact across multiple software ecosystems, highlighting their influence on ecosystem success and security.

Contribution

It provides the first comprehensive analysis of cross-ecosystem packages, detailing their prevalence, distribution patterns, and effects on multiple software ecosystems.

Findings

Few packages are distributed across multiple ecosystems.

Cross-ecosystem packages often support multiple ecosystems with new releases.

Such packages are popular among large developer communities.

Abstract

Software ecosystems are collections of projects that are developed and evolve together in the same environment. Existing literature investigates software ecosystems as isolated entities whose boundaries do not overlap and assumes they are self-contained. However, a number of software projects are distributed in more than one ecosystem. As different aspects, e.g., success, security vulnerabilities, bugs, etc., of such cross-ecosystem packages can affect multiple ecosystems, we investigate the presence and characteristics of these cross-ecosystem packages in 12 large software distributions. We found a small number of packages distributed in multiple packaging ecosystems and that such packages are usually distributed in two ecosystems. These packages tend to better support with new releases certain ecosystems, while their evolution can impact a multitude of packages in other ecosystems. Finally, such packages appear to be popular with large developer communities.