  Web developers routinely rely on third-party Java-Script libraries such as
jQuery to enhance the functionality of their sites. However, if not properly
maintained, such dependencies can create attack vectors allowing a site to be
compromised.
  In this paper, we conduct the first comprehensive study of client-side
JavaScript library usage and the resulting security implications across the
Web. Using data from over 133 k websites, we show that 37% of them include at
least one library with a known vulnerability; the time lag behind the newest
release of a library is measured in the order of years. In order to better
understand why websites use so many vulnerable or outdated libraries, we track
causal inclusion relationships and quantify different scenarios. We observe
sites including libraries in ad hoc and often transitive ways, which can lead
to different versions of the same library being loaded into the same document
at the same time. Furthermore, we find that libraries included transitively, or
via ad and tracking code, are more likely to be vulnerable. This demonstrates
that not only website administrators, but also the dynamic architecture and
developers of third-party services are to blame for the Web's poor state of
library management.
  The results of our work underline the need for more thorough approaches to
dependency management, code maintenance and third-party code inclusion on the
Web.
