CoChat
Sign Up
Cited by 7Software Engineering ResearchOpen Source Software InnovationsSoftware Reliability and Analysis Research

The DOI matches its Crossref record.

Technical leverage analysis in the Python ecosystem

Open access
Paramitha, Ranindya, Massacci, Fabio·2023·Empirical Software Engineering
DOI 10.1007/s10664-023-10355-2
Open this paper in CoChat — free accountOpen PDF

Abstract

Context: Technical leverage is the ratio between dependencies (other people’s code) and own codes of a software package. It has been shown to be useful to characterize the Java ecosystem and there are also studies on the NPM ecosystem available. Objective: By using this metric we aim to analyze the Python ecosystem, how it evolves, and how secure it is, as a developer would perceive it when deciding to adopt or update (or not) a library. Method: We collect a dataset of the top 600 Python packages (corresponding to 21,205 versions) and used a number of innovative approaches for its analysis including the use of a two-part statistical model to deal with excess zeros, a mathematical closed formulation to estimate vulnerabilities that we confirm with bootstrapping on the actual dataset. Results: Small Python package versions have a median technical leverage of 6.9x their own code, while bigger package versions rely on dependencies code a tenth of their own (median leverage of 0.1). In terms of evolution, Python packages tend to have stable technical leverage through their evolution (once highly leveraged, always leveraged). On security, the chance of getting a safe package version when choosing a package is actually better than previous research has shown based on the ratio of safe package versions in the ecosystem. Coclusions: Python packages ship a lot of other people’s code and tend to keep doing so. However, developers will have a good chance to choose a safe package version.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1007/s10664-023-10355-2

Cites

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Still being checked.

Research works printed but not linked: 39

  1. Alfadel M, Costa DE, Shihab E (2021) Empirical analysis of security vulnerabilities in python packages. 2021 IEEE International Conference on Software Analysis. Evolution and Reengineering (SANER), IEEE, pp 446–457 · DOI
  2. Allman E (2012) Managing technical debt. Commun ACM 55(5):50–55 · DOI
  3. Allodi L, Massacci F, Williams J (2022) The work-averse cyberattacker model: theory and evidence from two million attack signatures. Risk Anal 42(8):1623–1642 · DOI
  4. Bagmar A, Wedgwood J, Levin D, Purtilo J (2021) I know what you imported last summer: A study of security threats in the python ecosystem. arXiv:2102.06301 · arXiv
  5. Banker R, Liang Y, Ramasubbu N (2021) Technical debt and firm performance. Manage Sci 67(5):3174–3194 · DOI
  6. Bonaccorsi A, Rossi C (2003) Why open source software can succeed. Res Policy 32(7):1243–1258 · DOI
  7. Cox J, Bouwers E, Van Eekelen M, Visser J (2015) Measuring dependency freshness in software systems. In: 2015 IEEE/ACM 37th IEEE International Conference on Software Engineering, vol 2. IEEE, pp 109–118 · DOI
  8. Cunningham W (1992) The wycash portfolio management system. ACM SIGPLAN OOPS Messenger 4(2):29–30 · DOI
  9. Dashevskyi S, Brucker AD, Massacci F (2016) On the security cost of using a free and open source component in a proprietary product. In: International Symposium on Engineering Secure Software and Systems, Springer, pp 190–206 · DOI
  10. Decan A, Mens T, Constantinou E (2018) On the impact of security vulnerabilities in the npm package dependency network. In: Proceedings of the 15th International Conference on Mining Software Repositories (MSR), pp 181–191 · DOI
  11. Decan A, Mens T, Grosjean P (2019) An empirical comparison of dependency network evolution in seven software packaging ecosystems. Empir Softw Eng 24:381–416 · DOI
  12. Derr E, Bugiel S, Fahl S, Acar Y, Backes M (2017) Keep me updated: An empirical study of third-party library updatability on android. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, pp 2187–2200 · DOI
  13. Frakes WB, Kang K (2005) Software reuse research: Status and future. IEEE Trans Softw Eng 31(7):529–536 · DOI
  14. Gkortzis A, Feitosa D, Spinellis D (2021) Software reuse cuts both ways: An empirical analysis of its relationship with security vulnerabilities. J Syst Softw 172:110653 · DOI
  15. Hejderup J (2015) In dependencies we trust: How vulnerable are dependencies in software modules? PhD thesis, Computer Science, TU Delft
  16. Hejderup J, Beller M, Triantafyllou K, Gousios G (2022) Präzi: from package-based to call-based dependency networks. Empir Softw Eng 27(5):102 · DOI
  17. Huijgens H, Van Deursen A, Minku LL, Lokan C (2017) Effort and cost in software engineering: A comparison of two industrial data sets. In: Proceedings of the 21st International Conference on Evaluation and Assessment in Software Engineering, pp 51–60 · DOI
  18. Jorgensen M, Shepperd M (2006) A systematic review of software development cost estimation studies. IEEE Trans Softw Eng 33(1):33–53 · DOI
  19. Khoirom S, Sonia M, Laikhuram B, Laishram J, Singh TD (2020) Comparative analysis of python and java for beginners. Int Res J Eng Technol 7(8):4384–4407
  20. Kikas R, Gousios G, Dumas M, Pfahl D (2017) Structure and evolution of package dependency networks. In: 2017 IEEE/ACM 14th International Conference on Mining Software Repositories (MSR), IEEE, pp 102–112 · DOI
  21. Kula RG, German DM, Ouni A, Ishio T, Inoue K (2018) Do developers update their library dependencies? Empir Softw Eng 23(1):384–417 · DOI
  22. Lachenbruch PA (2002) Analysis of data with excess zeros. Stat Methods Med Res 11(4):297–302 · DOI
  23. Lauinger T, Chaabane A, Arshad S, Robertson W, Wilson C, Kirda E (2018) Thou shalt not depend on me: Analysing the use of outdated javascript libraries on the web. arXiv preprint arXiv:1811.00918 · DOI
  24. Manadhata PK, Wing JM (2010) An attack surface metric. IEEE Trans Softw Eng 37(3):371–386 · DOI
  25. Massacci F, Pashchenko I (2021) Technical leverage in a software ecosystem: Development opportunities and security risks. In: 2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE), IEEE, pp 1386–1397 · DOI
  26. Massacci F, Sabetta A, Mirkovic J, Murray T, Okhravi H, Mannan M, Rocha A, Bodden E, Geer DE (2022) “free’’ as in freedom to protest? IEEE Secur Priv 20(5):16–21 · DOI
  27. Pashchenko I, Plate H, Ponta SE, Sabetta A, Massacci F (2018) Vulnerable open source dependencies: Counting those that matter. In: Proceedings of the 12th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement, Association for Computing Machinery (ACM), ESEM ’18, https://doi.org/10.1145/3239235.3268920 · DOI
  28. Pashchenko I, Vu DL, Massacci F (2020) A qualitative study of dependency management and its security implications. In: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, pp 1513–1531 · DOI
  29. Pashchenko I, Plate H, Ponta SE, Sabetta A, Massacci F (2022) Vuln4real: A methodology for counting actually vulnerable dependencies. IEEE Transactions on Software Engineering 48(5):1592–1609. https://doi.org/10.1109/TSE.2020.3025443 · DOI
  30. Pittenger M (2016) Open source security analysis: The state of open source security in commercial applications. Black Duck Software, Tech Rep
  31. Prana GAA, Sharma A, Shar LK, Foo D, Santosa AE, Sharma A, Lo D (2021) Out of sight, out of mind? how vulnerable dependencies affect open-source projects. Empir Softw Eng 26(4):1–34 · DOI
  32. Ruohonen J, Hjerppe K, Rindell K (2021) A large-scale security-oriented static analysis of python packages in pypi. 2021 18th International Conference on Privacy. Security and Trust (PST), IEEE, pp 1–10 · DOI
  33. Slaughter SA, Harter DE, Krishnan MS (1998) Evaluating the cost of software quality. Commun ACM 41(8):67–73 · DOI
  34. Soto-Valero C, Durieux T, Baudry B (2021a) A longitudinal analysis of bloated java dependencies. In: Proceedings of the 29th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp 1021–1031 · DOI
  35. Soto-Valero C, Harrand N, Monperrus M, Baudry B (2021) A comprehensive study of bloated dependencies in the maven ecosystem. Empir Softw Eng 26(3):1–44 · DOI
  36. Stokey NL (2008) The Economics of Inaction: Stochastic Control models with fixed costs. Princeton University Press · DOI
  37. Vu DL, Pashchenko I, Massacci F, Plate H, Sabetta A (2020) Typosquatting and combosquatting attacks on the python ecosystem. In: 2020 ieee european symposium on security and privacy workshops (euros &pw), IEEE, pp 509–514 · DOI
  38. Wang Y, Chen B, Huang K, Shi B, Xu C, Peng X, Wu Y, Liu Y (2020) An empirical study of usages, updates and risks of third-party libraries in java projects. In: 2020 IEEE International Conference on Software Maintenance and Evolution (ICSME), IEEE, pp 35–45 · DOI
  39. Zimmermann M, Staicu CA, Tenny C, Pradel M (2019) Small world with high risks: A study of security threats in the npm ecosystem. In: 28th USENIX Security Symposium (USENIX Security 19), pp 995–1010

Cited by

Sorted by citations

See all 7

Metadata

Authors
Paramitha, R., & Massacci, F.
Affiliations
University of Trento (IT)
Corresponding author
Paramitha, Ranindya
ORCID
Venue
Empirical Software Engineering
Publisher
Springer Science and Business Media LLC
Published
2023-10-13
Volume
28
Issue
6
ISSN
  • 1382-3256 (ISSN-L)
  • 1573-7616
DOI
10.1007/s10664-023-10355-2
OpenAlex
W4387603930
Cited by
7
References
0
Citations by year
2026: 3 · 2025: 4
FWCI
1.65
Type
journal article
Language
en
Open access
Licence
Locations
  • Empirical Software Engineering (publishedVersion, cc-by)
  • Institutional Research Information System (Università degli Studi di Trento) (submittedVersion, cc-by)
  • VU Research Portal (submittedVersion, other-oa)
Funders
H2020 LEIT Information and Communication Technologies (952647)
Topics
  • Physical Sciences › Computer Science › Information Systems › Software Engineering Research
  • Physical Sciences › Computer Science › Computer Science Applications › Open Source Software Innovations
  • Physical Sciences › Computer Science › Software › Software Reliability and Analysis Research
Keywords
Python library, software dependencies, software ecosystems, software security, vulnerability assessment, software evolution, open-source library

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: Technical leverage analysis in the Python ecosystem. https://app.cochat.ai/papers/10.1007/s10664-023-10355-2
The paper
Paramitha, R., & Massacci, F. (2023). Technical leverage analysis in the Python ecosystem. Empirical Software Engineering. https://doi.org/10.1007/s10664-023-10355-2