Sonatype, a company specializing in protection against attacks manipulating software components and dependencies (supply chain), has published the results of a study (PDF, 62 pages) on the issues with dependencies and maintenance of open projects in Java, JavaScript, Python, and .NET languages found in the Maven Central, NPM, PyPl, and Nuget repositories. Over the past year, the number of projects in tracked open ecosystems has increased by an average of 29%. The number of package downloads from the examined repositories in 2023 rose by 33%, while in 2021, downloads increased by 73% for comparison.
Malicious activity in repositories has significantly increased — since the beginning of the year, 245 thousand malicious packages have been identified, and the number of recorded attacks targeting dependency manipulation has doubled.
Many projects continue to use vulnerable versions; for instance, 23% of downloads of the Java package Log4j still consist of versions with critical vulnerabilities that were fixed in 2021. In the Maven Central repository, about 12% of all downloads involve components containing known vulnerabilities. On average, across all repositories, the share of downloads of older package versions classified as risky (for example, with unpatched vulnerabilities) is 20% (in 80% of cases, the latest version is downloaded). In 96% of cases, downloads of vulnerable components could have been avoided by selecting versions in which the issue has already been resolved.
Maintaining project security also poses a significant problem due to quality support. In ecosystems for Java and JavaScript languages, there are major challenges — over the past year, support for every fifth project (18.6%) represented in Maven Central and NPM, which was maintained in the previous year, has been discontinued. Out of 1.176 million analyzed projects present in the Maven, NPM, PyPl, and Nuget repositories, only 11% (118 thousand) continue to be actively maintained.
The research also included a survey of 621 professional developers from various companies. 67% of respondents believe that their applications do not use vulnerable libraries, 10% have encountered security incidents in the past 12 months caused by vulnerabilities in open source software, while 20% are unsure. 28% of companies identify the presence of vulnerable components within 1 day after vulnerability disclosure, 39% — from 1 to 7 days, and 29% — more than a week.
Source: opennet.ru
