Assessing the risks posed by outdated dependencies in software supplychains: a focus on the NPM ecosystem

The security of the open source software supply chain, especially the issue of outdated dependencies, has always been a major concern for developers. This study explores in depth the frequency of outdated dependencies in the NPM ecosystem and their impact on software security. By analyzing NPM registry data and reviewing related vulnerability reports, we built a model called Vulnerability Aware Outdated Dependencies Supply Chain (VOD-SC) to help assess the associated risks. The results show that 42.7% of packages in the NPM ecosystem have not been updated in more than two years, and nearly half of the dependencies are in an outdated state, which poses a serious security concern. Although only a small number of outdated dependencies are directly related to known vulnerabilities, critical packages - especially those that are relied upon by a large number of projects - have a far greater impact on the software supply chain than general dependencies. By adopting frameworks such as the Universal Flaw Enumeration (CWE) and the Common Vulnerability Scoring System (CVSS), we identified critical security risks, with injection vulnerabilities in development tools (CWE-707) being one of the main concerns. In addition, we use Louvain algorithm to analyze the distribution of outdated dependencies in different domains, and the results show that it is important to update dependencies regularly. This study provides practical security recommendations for developers and maintainers in the NPM ecosystem to better address the challenges posed by aging dependencies.