.png){kind=icon}
Return
Dependency Network Structure and Security Vulnerabilities in Software Supply Chains
.png){kind=icon}
PRE
AI
DOI：10.1080/07421222.2025.2561385.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Software packages can be susceptible to attack whenever they utilize dependencies containing security vulnerabilities (vulnerable dependencies). We theorize that the likelihood of relying on vulnerable dependencies is heightened by two structural dimensions of dependency networks: complexity (dependency count) and tight coupling (interdependence). Analyzing 40,049 packages, we find that complexity is positively associated with this likelihood and that vertical complexity (depth) plays a more prominent role than horizontal complexity (breadth). However, tight coupling is negatively associated with the likelihood of vulnerable dependencies. Further analyses reveal that this relationship turns positive with greater complexity but becomes more strongly negative as the number of package developers and the average number of developers per dependency increase. Our findings identify key boundary conditions under which tight coupling may be beneficial and offer a nuanced understanding of how dependency network structure influences the security of dependencies and, more broadly, the security of software supply chains.
Keywords:
Dependency network
security vulnerability
vulnerable dependency
software complexity
software coupling
software supply chain
cybersecurity
Journal
J
IF:
6.2
Papers:
43
Citations:
0
Organization
View more organizations
Cited Papers
.png){kind=icon}
ShareSaveShareSaveStructural drivers of upstream supply chain complexity and the frequency of supply chain disruptions
OAAI
OAAIShareSaveShareSave View more