PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks

• URL: http://arxiv.org/abs/2609.13719v1
• Date: Sat, 12 Sep 2026 05:09:17 GMT
• Title: PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks
• Abstract summary: We construct a leakage-aware benchmark from Open Source advisories and deps.dev dependency graphs for npm and PyPI.<n>We evaluate three feature families: TimeOnly, GraphStruct, and HistoryGraph.
• Score: 0.42821598129654453
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its transitive dependencies later receives a vulnerability advisory. Existing vulnerability-detection work often focuses on whether code is currently vulnerable or whether a known vulnerable dependency is already present. We study a different problem: future transitive vulnerability exposure. Given a package-version dependency graph observed at release time, the task is to predict whether any non-root dependency will receive a vulnerability advisory within a future horizon. This problem is important for Web intelligence and software supply-chain security because it supports proactive dependency triage before future exposure is visible. It is also easy to evaluate incorrectly: current vulnerable dependencies can leak the label, and different versions of the same root package can create package-level memorization across train and test splits. We therefore construct PatchRisk, a leakage-aware benchmark from Open Source Vulnerability advisories and deps.dev dependency graphs for npm and PyPI. The benchmark uses filtration-aware labels, package-disjoint evaluation, temporal testing, and nested 1K, 3K, 5K, and 10K sampling scales. The largest cleaned setting contains 9,007 root package-version graphs spanning 4,157 root packages. We evaluate three feature families: TimeOnly, GraphStruct, and HistoryGraph. On the 10K temporal-test benchmark, HistoryGraph improves AUPRC over the strongest TimeOnly baseline from 0.351 to 0.640 for 90-day forecasting and from 0.473 to 0.813 for 365-day forecasting. The improvement remains stable across smaller scales and package-group shuffle robustness tests.

Related papers

• VEX-Bench: Benchmarking LLM Agents for Assessing Exploitability of Software Supply Chain Vulnerabilities [8.261542578922597]
  We introduce the first benchmark for evaluating LLM agents' ability to assess the exploitability of software supply chain vulnerabilities.<n>VEX-Bench contains 75 real-world cases mined from GitHub and labeled by security experts, covering Python, Java, and Go.<n>While GPT-5.5 and Claude Opus 4.6 reach approximately 80% F1 on binary vulnerability-status classification, only GPT-5.5 surpasses 70% macro-F1 on fine-grained justification classification.
  arXiv  Detail & Related papers  (2026-09-07T22:52:09Z)
• Original Sin of npm: A Study on Vulnerability Propagation in JavaScript Dependency Networks [16.016433368001504]
  This paper presents insights from 1,515 reported vulnerabilities gathered from a custom-built vulnerability database.<n>It takes, on average, approximately 4 years and 11 months to fix a vulnerable package from when the first vulnerable version is published on npm.
  arXiv  Detail & Related papers  (2026-04-19T23:44:28Z)
• Credential Leakage in LLM Agent Skills: A Large-Scale Empirical Study [51.717224133855886]
  Third-party skills extend LLM agents with powerful capabilities but often handle sensitive credentials in privileged environments.<n>We analyze 17,022 skills (sampled from 170,226 on SkillsMP) using static analysis, sandbox testing, and manual inspection.<n>We identify 520 vulnerable skills with 1,708 issues and derive a taxonomy of 10 leakage patterns (4 accidental and 6 adversarial)
  arXiv  Detail & Related papers  (2026-04-03T14:50:16Z)
• Cross-Ecosystem Vulnerability Analysis for Python Applications [8.776396282382864]
  Python applications depend on native libraries that may be vendored within package distributions or installed on the host system.<n>Current vulnerability scanners produce false negatives by missing vendored vulnerabilities and false positives by ignoring security patches backported by OS distributions.<n>We present a provenance-aware vulnerability analysis approach that resolves vendored libraries to specific OS package versions or upstream releases.
  arXiv  Detail & Related papers  (2026-03-19T09:52:29Z)
• Outrunning LLM Cutoffs: A Live Kernel Crash Resolution Benchmark for All [57.23434868678603]
  Live-kBench is an evaluation framework for self-evolving benchmarks that scrapes and evaluates agents on freshly discovered kernel bugs.<n> kEnv is an agent-agnostic crash-resolution environment for kernel compilation, execution, and feedback.<n>Using kEnv, we benchmark three state-of-the-art agents, showing that they resolve 74% of crashes on the first attempt.
  arXiv  Detail & Related papers  (2026-02-02T19:06:15Z)
• Forecasting the Maintained Score from the OpenSSF Scorecard for GitHub Repositories linked to PyPI libraries [78.48200143057376]
  We study to what extent future maintenance activity, as captured by the OpenSSF maintained score, can be forecasted.<n>We analyze 3,220 GitHub repositories associated with the top 1% most central PyPI libraries by PageRank.<n>Our results show that future maintenance activity can be predicted with meaningful accuracy.
  arXiv  Detail & Related papers  (2026-01-26T10:32:54Z)
• What Do They Fix? LLM-Aided Categorization of Security Patches for Critical Memory Bugs [46.325755802511026]
  We developLM, a dual-method pipeline that integrates two approaches based on a Large Language Model (LLM) and a fine-tuned small language model.<n>LM successfully identified 111 of 5,140 recent Linux kernel patches addressing OOB or UAF vulnerabilities, with 90 true positives confirmed by manual verification.
  arXiv  Detail & Related papers  (2025-09-26T18:06:36Z)
• Faster Releases, Fewer Risks: A Study on Maven Artifact Vulnerabilities and Lifecycle Management [0.14999444543328289]
  We analyze the release histories of 10,000 Maven artifacts, covering over 203,000 releases and 1.7 million dependencies.<n>Our results show an inverse relationship between release speed and dependency outdatedness.<n>These findings emphasize the importance of accelerated release strategies in reducing security risks.
  arXiv  Detail & Related papers  (2025-03-31T17:32:45Z)
• Analyzing the Usage of Donation Platforms for PyPI Libraries [91.97201077607862]
  This study analyzes the adoption of donation platforms in the PyPI ecosystem.<n> GitHub Sponsors is the dominant platform, though many PyPI-listed links are outdated.
  arXiv  Detail & Related papers  (2025-03-11T10:27:31Z)
• Discovery of Timeline and Crowd Reaction of Software Vulnerability Disclosures [47.435076500269545]
  Apache Log4J was found to be vulnerable to remote code execution attacks. More than 35,000 packages were forced to update their Log4J libraries with the latest version. It is practically reasonable for software developers to update their third-party libraries whenever the software vendors have released a vulnerable-free version.
  arXiv  Detail & Related papers  (2024-11-12T01:55:51Z)
• How Quickly Do Development Teams Update Their Vulnerable Dependencies? [3.5472726784546076]
  Mean-Time-To-Update (MTTU) and Mean-Time-To-Remediate for vulnerable dependencies (MTTR)<n>We propose two novel metrics, Mean-Time-To-Update for dependencies (MTTU) and Mean-Time-To-Remediate for vulnerable dependencies (MTTR)
  arXiv  Detail & Related papers  (2024-03-26T05:01:53Z)
• Dependency Practices for Vulnerability Mitigation [4.710141711181836]
  We analyze more than 450 vulnerabilities in the npm ecosystem to understand why dependent packages remain vulnerable. We identify over 200,000 npm packages that are infected through their dependencies. We use 9 features to build a prediction model that identifies packages that quickly adopt the vulnerability fix and prevent further propagation of vulnerabilities.
  arXiv  Detail & Related papers  (2023-10-11T19:48:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.