Systematic literature review of the trust reinforcement mechanisms exist in package ecosystems

TL;DR

This systematic literature review analyzes existing trust reinforcement mechanisms in package ecosystems, focusing on npm security tools, user responses, and integration challenges to identify trends and gaps.

Contribution

It provides a comprehensive overview of trust tools in npm, highlighting current challenges, user behaviors, and areas needing further research.

Findings

Identifies key trust reinforcement strategies in npm.

Highlights user response patterns to security warnings.

Pinpoints gaps in current trust mechanisms.

Abstract

We conducted a thorough SLR to better grasp the challenges and possible solutions associated with existing npm security tools. Our goal was to delve into documented experiences and findings. Specifically, we were keen to learn about the motivations behind choosing third-party packages, software engineers' responses to warning messages, and their overall understanding of security issues. The main aim of this review was to pinpoint prevailing trends, methods, and concerns in trust tools for the present npm environment. Furthermore, we sought to understand the complexities of integrating SECO into platforms such as npm. By analyzing earlier studies, our intention was to spot any overlooked areas and steer our research to address them.