Maven maintainers patch critical vulnerabilities about 48% faster than low-severity ones after public disclosure, and dependent packages take a median of 151 days to adopt available fixes.
OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics
1 Pith paper cite this work. Polarity classification is still indexing.
1
Pith paper citing it
abstract
The OpenSSF Scorecard project is an automated tool to monitor the security health of open-source software. This study evaluates the applicability of the Scorecard tool and compares the security practices and gaps in the npm and PyPI ecosystems.
fields
cs.SE 1years
2025 1verdicts
CONDITIONAL 1representative citing papers
citing papers explorer
-
Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks
Maven maintainers patch critical vulnerabilities about 48% faster than low-severity ones after public disclosure, and dependent packages take a median of 151 days to adopt available fixes.