npmSECO: A Tool for Integrating Trust into the Software Ecosystem

Abstract

Selecting software packages is challenging due to the multitude of trust factors involved, such as functionality, compatibility, security, or maintenance, which often requires comprehensive analysis and cross-referencing. Additionally, the tons of software packages and their dependencies can overwhelm decision-makers, leading to potential oversights and inefficiencies in the selection process for critical vulnerabilities. This paper introduces npmSECO, an open-source initiative designed to evaluate the trust and security of software packages before and after installation. We infuse trust data, including trust factors and scores, into a package ecosystem - npm, which is well known for its vulnerabilities and extensive dependency tree to create a more secure environment for software engineers to produce software in. Trust scores and factors are displayed in the command line interface, helping software engineers access rich information for software evaluation in one place before the package installation. We conducted 20 interviews with software engineers to assess this tool. Preliminary feedback indicates that npmSECO offers a high level of usability.