  Relying on dependency packages accelerates software development, but it also
increases the exposure to security vulnerabilities that may be present in
dependencies. While developers have full control over which dependency packages
(and which version) they use, they have no control over the dependencies of
their dependencies. Such transitive dependencies, which often amount to a
greater number than direct dependencies, can become infected with
vulnerabilities and put software projects at risk. To mitigate this risk,
Practitioners need to select dependencies that respond quickly to
vulnerabilities to prevent the propagation of vulnerable code to their project.
To identify such dependencies, we analyze more than 450 vulnerabilities in the
npm ecosystem to understand why dependent packages remain vulnerable. We
identify over 200,000 npm packages that are infected through their dependencies
and use 9 features to build a prediction model that identifies packages that
quickly adopt the vulnerability fix and prevent further propagation of
vulnerabilities. We also study the relationship between these features and the
response speed of vulnerable packages. We complement our work with a
practitioner survey to understand the applicability of our findings. Developers
can incorporate our findings into their dependency management practices to
mitigate the impact of vulnerabilities from their dependency supply chain.
