Security Issues in Language-based Software Ecosystems

Understand

Language-based ecosystems (LBE), i.e., software ecosystems based on a single programming language, are very common.

• Examples include the npm ecosystem for JavaScript, and PyPI for Python.
• These environments encourage code reuse between packages, and incorporate utilities - package managers - for automatically resolving dependencies.
• However, the same aspects that make these systems popular - ease of publishing code and importing external code - also create novel security issues, which have so far seen little study.