A Time Series Analysis of Malware Uploads to Programming Language Ecosystems

2025-04-22

AI Summary

This study addresses the longitudinal security evolution of malware uploads within programming language ecosystems. Leveraging the OSV database, we construct time-series datasets covering six major language ecosystems. We empirically reveal— for the first time—that as of early 2025, malware entries have surpassed traditional vulnerability entries in count, constituting 80% of all security advisories—a fundamental shift in the threat landscape. Methodologically, we integrate multi-source predictive features—including ecosystem scale, security advisories, and media coverage—and employ a lightweight autoregressive (AR) model to achieve high-accuracy forecasting of malware upload frequency and proportion. Our core contributions are twofold: (1) establishing the first longitudinal security analysis paradigm specifically designed for software-ecosystem-level malware uploads; and (2) empirically identifying the critical inflection point at which malware entries overtake vulnerabilities—thereby providing a novel theoretical foundation and actionable framework for ecosystem-scale threat sensing and response.

Technology Category

Machine Learning: Time-Series/Data StreamsApplication Domains: SecurityMultiagent Systems: Adversarial Agents

Application Category

Security and Privacy: Large-scale security measurementsUser Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systemsSystems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Software ecosystems built around programming languages have greatly facilitated software development. At the same time, their security has increasingly been acknowledged as a problem. To this end, the paper examines the previously overlooked longitudinal aspects of software ecosystem security, focusing on malware uploaded to six popular programming language ecosystems. The dataset examined is based on the new Open Source Vulnerabilities (OSV) database. According to the results, records about detected malware uploads in the database have recently surpassed those addressing vulnerabilities in packages distributed in the ecosystems. In the early 2025 even up to 80% of all entries in the OSV have been about malware. Regarding time series analysis of malware frequencies and their shares to all database entries, good predictions are available already by relatively simple autoregressive models using the numbers of ecosystems, security advisories, and media and other articles as predictors. With these results and the accompanying discussion, the paper improves and advances the understanding of the thus far overlooked longitudinal aspects of ecosystems and malware.

Problem

• Analyzing malware uploads in programming language ecosystems over time
• Predicting malware trends using autoregressive models and ecosystem data
• Improving understanding of longitudinal security risks in software ecosystems

Innovation

• Longitudinal analysis of malware in ecosystems
• Uses Open Source Vulnerabilities (OSV) database
• Simple autoregressive models for malware prediction