Opportunities and Security Risks of Technical Leverage: A Replication Study on the NPM Ecosystem

TL;DR

This study replicates and extends prior research on technical leverage in software ecosystems, analyzing NPM dependencies to reveal how reuse accelerates development but also increases security vulnerabilities.

Contribution

It expands previous work by including transitive dependencies in the analysis of NPM, quantifying leverage opportunities and security risks at scale.

Findings

Small-medium libraries leverage 2.5x more FOSS code than their own.

Large libraries leverage only 3% of FOSS code.

High technical leverage increases vulnerability exposure risk by 4-7 times.

Abstract

To comply with high productivity demands, software developers reuse free open-source software (FOSS) code to avoid reinventing the wheel when incorporating software features. The reliance on FOSS reuse has been shown to improve productivity and the quality of delivered software; however, reusing FOSS comes at the risk of exposing software projects to public vulnerabilities. Massacci and Pashchenko have explored this trade-off in the Java ecosystem through the lens of technical leverage: the ratio of code borrowed from FOSS over the code developed by project maintainers. In this paper, we replicate the work of Massacci and Pashchenko and we expand the analysis to include level-1 transitive dependencies to study technical leverage in the fastest-growing NPM ecosystem. We investigated 14,042 NPM library releases and found that both opportunities and risks of technical leverage are magnified in the NPM ecosystem. Small-medium libraries leverage 2.5x more code from FOSS than their code, while large libraries leverage only 3\% of FOSS code in their projects. Our models indicate that technical leverage shortens the release cycle for small-medium libraries. However, the risk of vulnerability exposure is 4-7x higher for libraries with high technical leverage. We also expanded our replication study to include the first level of transitive dependencies, and show that the results still hold, albeit with significant changes in the magnitude of both opportunities and risks of technical leverage. Our results indicate the extremes of opportunities and risks in NPM, where high technical leverage enables fast releases but comes at the cost of security risks.