Is anyone aware of any quantitative analysis or research on the security of CRAN or NPM?

e.g. How much malware is hosted, rate of compromise, speed to close, number of attack vectors, CERT reports etc etc.

I'm trying to get a sense of the level of risk of compromised libs and dependencies in any of the major open source repos.

While papers like this are useful (though dated)


I'm interested specifically in repositories rather than FOSS in general.

  • can you link to those sources?
    – schroeder
    Commented Oct 19, 2015 at 18:37

1 Answer 1


Though this is not a research paper it may give you some insight into NPM:

A Malicious Module on NPM

Just because the package system is "Open Source" does not mean it isn't managed. Take the Apple App Store for example, the most widely used mobile device brand in the world and even they have issues managing the saftey of the downloads they provide.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .