Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM?

e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports etc etc.

I'm trying to get a sense of the level of risk of compromised libs and dependencies in any of the major open source repos.

While papers like this are useful (though dated)


I'm interested specifically in repositories rather than FOSS in general.

  • can you link to those sources?
    – schroeder
    Oct 19, 2015 at 18:37

1 Answer 1


Though this is not a research paper it may give you some insight into NPM:

A Malicious Module on NPM

Just because the package system is "Open Source" does not mean it isn't managed. Take the Apple App Store for example, the most widely used mobile device brand in the world and even they have issues managing the saftey of the downloads they provide.

  • The ^lift article was very good. Thank you Chad.
    – Colin
    Dec 2, 2015 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.