Researchers from Aqua Security have published the results of an analysis of statistics on the 50,000 most downloaded packages in the NPM repository. Of these, 7,500 (15%) of the most downloaded packages were found to be associated with deprecated packages and projects that have ceased to exist. To simplify the identification of deprecated packages among the dependencies used in their projects, a tool called Dependency-Deprecated-Checker has been proposed, published under the MIT license.
In 4,100 (8.2%) of the examined packages in the dependency chain, packages officially declared deprecated in NPM or associated with obsolete projects were identified (for example, the request package is marked as deprecated but continues to be used as a direct dependency by 55,000 packages). 2,300 (4.6%) packages are linked to GitHub repositories that have been archived (development has ceased; for instance, the through package's repository is marked as archived but is used as a direct dependency in 3,000 packages). 1,100 (2.2%) packages refer to repositories that no longer exist, resulting in a 404 error when accessed. 3,100 (6.2%) packages contain no information about repositories.
In absolute terms, the prevalence of deprecated packages and packages without repository links in NPM is extrapolated to approximately 2.1 billion downloads per week. The use of deprecated packages and abandoned projects as dependencies poses the risk of having unpatched vulnerabilities, especially given the practice by some developers of quietly removing vulnerabilities without assigning a CVE identifier and without explicitly drawing attention to the resolution of the issue.
Source: opennet.ru
