What's in a Package? Getting Visibility Into Dependencies Using Security-Sensitive API Calls
Imranur Rahman, Ranidya Paramitha, Henrik Plate, Dominik Wermke, Laurie Williams
TL;DR
The paper addresses the need for deeper visibility into dependencies beyond metadata by introducing security-sensitive APIs as a concrete risk signal and applying call-graph analysis to the Java/Maven ecosystem. It presents a novel three-pronged method to construct a 219-API list linked to CWEs, builds intra- and inter-package call graphs, and compares usage across 1,210 packages, complemented by a developer survey of 110 participants. Key findings show substantial presence of security-sensitive API calls, significant increases due to transitive dependencies, and varying patterns across package groups, with half of developers indicating a willingness to consider this information in dependency choices. The work advocates integrating security-sensitive API data into dependency management tools and CI/CD pipelines to improve supply-chain security and informs future research on broader ecosystem applicability and longitudinal analyses.
Abstract
Knowing what sensitive resources a dependency could potentially access would help developers assess the risk of a dependency before selection. One way to get an understanding of the potential sensitive resource usage by a dependency is using security-sensitive APIs, i.e., the APIs that provide access to security-sensitive resources in a system, e.g., the filesystem or network resources. However, the lack of tools or research providing visibility into potential sensitive resource usage of dependencies makes it hard for developers to use this as a factor in their dependency selection process. The goal of this study is to aid developers in assessing the security risks of their dependencies by identifying security-sensitive APIs in packages through call graph analysis. In this study, we present a novel methodology to construct a security-sensitive API list for an ecosystem to better understand and assess packages before selecting them as a dependency. We implement the methodology in Java. We then compare the prevalence of security-sensitive APIs in functionally similar package groups to understand how different functionally similar packages could be in terms of security-sensitive APIs. We also conducted a developer survey (with 110 respondents) to understand developers' perceptions towards using security-sensitive API information in the dependency selection process. More than half of the developers would use security-sensitive API information in the dependency selection process if available. Finally, we advocate for incorporating security-sensitive API information into dependency management tools for easier access to the developers in the dependency selection process.