  Industrial applications heavily rely on open-source software (OSS) libraries,
which provide various benefits. But, they can also present a substantial risk
if a vulnerability or attack arises and the community fails to promptly address
the issue and release a fix due to inactivity. To be able to monitor the
activities of such communities, a comprehensive list of repositories for the
libraries of an ecosystem must be accessible. Based on these repositories,
integrated libraries of an application can be monitored to observe whether they
are adequately maintained. In this descriptive study, we analyze the
accessibility of GitHub repositories for PyPI and NPM libraries. For all
available libraries, we extract assigned repository URLs, direct dependencies
and use the page rank algorithm to comprehensively analyze the ecosystems from
a library and dependency chain perspective. For invalid repository URLs, we
derive potential reasons. Both ecosystems show varying accessibility to GitHub
repository URLs, depending on the page rank score of the analyzed libraries.
For individual libraries, up to 73.8% of PyPI and up to 69.4% of NPM libraries
have repository URLs. Within dependency chains, up to 80.1% of PyPI libraries
have URLs, while up to 81.1% for NPM. That means, most libraries, especially
the ones of increasing importance, can be monitored on GitHub. Among the most
common reasons for invalid repository URLs is no URLs being assigned at all,
which amounts up to 17.9% for PyPI and up to 39.6% for NPM. Package maintainers
should address this issue and update the repository information to enable
monitoring of their libraries.
