  Developers rely on open-source packages and must review dependencies to
safeguard against vulnerable or malicious upstream code. A careful review of
all dependencies changes often does not occur in practice. Therefore,
developers need signals to inform of dependency changes that require additional
examination. The goal of this study is to help developers prioritize dependency
review efforts by analyzing contributor reputation measures as a signal. We use
network centrality measures to proxy contributor reputation using collaboration
activity. We employ a mixed method methodology from the top 1,644 packages in
the Rust ecosystem to build a network of 6,949 developers, survey 285
developers, and model 5 centrality measures. We find that only 24% of
respondents often review dependencies before adding or updating a package,
mentioning difficulties in the review process. Additionally, 51% of respondents
often consider contributor reputation when reviewing dependencies. The
closeness centrality measure is a significant factor in explaining how
developers review dependencies. Yet, centrality measures alone do not account
for how developers choose to review dependencies. We recommend that ecosystems
like GitHub, Rust, and npm implement a contributor reputation badge based on
our modeled coefficients to aid developers in dependency reviews.
