  The popularity of JavaScript has lead to a large ecosystem of third-party
packages available via the npm software package registry. The open nature of
npm has boosted its growth, providing over 800,000 free and reusable software
packages. Unfortunately, this open nature also causes security risks, as
evidenced by recent incidents of single packages that broke or attacked
software running on millions of computers. This paper studies security risks
for users of npm by systematically analyzing dependencies between packages, the
maintainers responsible for these packages, and publicly reported security
issues. Studying the potential for running vulnerable or malicious code due to
third-party dependencies, we find that individual packages could impact large
parts of the entire ecosystem. Moreover, a very small number of maintainer
accounts could be used to inject malicious code into the majority of all
packages, a problem that has been increasing over time. Studying the potential
for accidentally using vulnerable code, we find that lack of maintenance causes
many packages to depend on vulnerable code, even years after a vulnerability
has become public. Our results provide evidence that npm suffers from single
points of failure and that unmaintained packages threaten large code bases. We
discuss several mitigation techniques, such as trusted maintainers and total
first-party security, and analyze their potential effectiveness.
