Hidden structural risk in software trust networks

Abstract

Modern software is built on chains of implicit trust — each package dependency is a trust relationship. Recent attacks, most notably xz-utils (2024), demonstrate that these trust relationships are now deliberate attack vectors. We analyze the PyPI and npm dependency networks and show that both exhibit scale-free fragility: robust to random node removals but vulnerable to targeted attacks. We introduce the bridge score, a simple metric that identifies packages that are important to the ecosystem but not popular — the xz-utils equivalents in the ecosystem. In PyPI, the top bridge packages are dominated by machine learning infrastructure; in npm, by small utility libraries — in both cases invisible to download-based risk metrics. These are the packages typically overlooked by security and open source funding efforts.