Towards Using Package Centrality Trend to Identify Packages in Decline

Abstract

Due to its increasing complexity, today's software systems are frequently built by leveraging reusable code in the form of libraries and packages. Software ecosystems (e.g., npm) are the primary enablers of this code reuse, providing developers with a platform to share their own and use others' code. These ecosystems evolve rapidly: developers add new packages every day to solve new problems or provide alternative solutions, causing obsolete packages to decline in their importance to the community. Developers should avoid depending on packages in decline, as these packages are reused less over time and may become less frequently maintained. However, current popularity metrics (e.g., Stars, and Downloads) are not fit to provide this information to developers because their semantics do not aptly capture shifts in the community interest.In this paper, we propose a scalable approach that uses the package's centrality in the ecosystem to identify packages in decline. We evaluate our approach with the npm ecosystem and show that the trends of centrality over time can correctly distinguish packages in decline with an ROC-AUC of 0.9. The approach can capture 87% of the packages in decline, on average 18 months before the trend is shown in currently used package popularity metrics. We implement this approach in a tool that can be used to augment npms metrics and help developers avoid packages in decline when reusing packages from npm.

On the impact of security vulnerabilities in the npm and RubyGems dependency networks

“…This way, even dependents that need to stick to older major releases could still benefit from the backported vulnerability fix. Perhaps popular packages with a high package centrality [50] can benefit from community support in bringing such backports to older major releases.…”

OSSARA: Abandonment Risk Assessment for Embedded Open Source Components

“…The results indicated that the number of connections as well as the dependency network position are significant factors affecting the projects' sustainability. Later, Mujahid et al 7 proposed a scalable approach that relies on the package centrality in an ecosystem to identify packages in decline. The results of an evaluation conducted on the Node Package Manager ecosystem showed strong prediction capabilities, thus indicating centrality as an important factor for forecasting project abandonment.…”