  Language-based ecosystems (LBE), i.e., software ecosystems based on a single
programming language, are very common. Examples include the npm ecosystem for
JavaScript, and PyPI for Python. These environments encourage code reuse
between packages, and incorporate utilities - package managers - for
automatically resolving dependencies. However, the same aspects that make these
systems popular - ease of publishing code and importing external code - also
create novel security issues, which have so far seen little study.
  We present an a systematic study of security issues that plague LBEs. These
issues are inherent to the ways these ecosystems work and cannot be resolved by
fixing software vulnerabilities in either the packages or the utilities, e.g.,
package manager tools, that build these ecosystems. We systematically
characterize recent security attacks from various aspects, including attack
strategies, vectors, and goals. Our characterization and in-depth analysis of
npm and PyPI ecosystems, which represent the largest LBEs, covering nearly one
million packages indicates that these ecosystems make an opportune environment
for attackers to incorporate stealthy attacks.
  Overall, we argue that (i) fully automated detection of malicious packages is
likely to be unfeasible; however (ii) tools and metrics that help developers
assess the risk of including external dependencies would go a long way toward
preventing attacks.
