Forecasting future security risks in open source software dependencies
PatchRisk: Forecasting Future Vulnerability Exposure in Open-Source Dependency Networks
Cryptography and SecuritySoftware Engineering
Summary
Software projects often rely on other software packages to work properly. Sometimes, those packages can have security problems that are not obvious right away. This paper studies how to predict if any of these dependent packages might get security warnings in the future, even before those problems appear. The authors created a special test set to avoid mistakes when predicting and developed new methods that improve forecasting accuracy. This helps developers prepare and reduce risks before vulnerabilities actually show up.
What this means in practice
- •For software security teams: Identify which open-source dependencies might receive future security advisories to focus proactive risk management.
- •For package maintainers: Plan updates and patches by anticipating likely future vulnerabilities in packages depended on by others.
Authors
Ashfaq Ali Shafin, Khandaker Mamun Ahmed
Abstract
Open-source software ecosystems are web-scale dependency networks. A downstream package can become exposed to security risk not because its own source code changes, but because one of its transitive dependencies later receives a vulnerability advisory. Existing vulnerability-detection work often focuses on whether code is currently vulnerable or whether a known vulnerable dependency is already present. We study a different problem: future transitive vulnerability exposure. Given a package-version dependency graph observed at release time, the task is to predict whether any non-root dependency will receive a vulnerability advisory within a future horizon. This problem is important for Web intelligence and software supply-chain security because it supports proactive dependency triage before future exposure is visible. It is also easy to evaluate incorrectly: current vulnerable dependencies can leak the label, and different versions of the same root package can create package-level memorization across train and test splits. We therefore construct PatchRisk, a leakage-aware benchmark from Open Source Vulnerability advisories and deps.dev dependency graphs for npm and PyPI. The benchmark uses filtration-aware labels, package-disjoint evaluation, temporal testing, and nested 1K, 3K, 5K, and 10K sampling scales. The largest cleaned setting contains 9,007 root package-version graphs spanning 4,157 root packages. We evaluate three feature families: TimeOnly, GraphStruct, and HistoryGraph. On the 10K temporal-test benchmark, HistoryGraph improves AUPRC over the strongest TimeOnly baseline from 0.351 to 0.640 for 90-day forecasting and from 0.473 to 0.813 for 365-day forecasting. The improvement remains stable across smaller scales and package-group shuffle robustness tests.