How to gauge open source package health: Tools and practices for picking the best package

Description

The pressure on application development teams has never been higher. Organizations of all sizes and types depend on their development teams to build amazing products and digital experiences that keep users happy. And shifting road maps and requirements often leave developers scrambling to deliver with less time than they’d like. With pressure to move fast, there’s an accompanying need to automate today’s manual approaches to researching and selecting open source packages. When development teams don’t approach this vetting process comprehensively, they can get bogged down in wrangling dependency issues and open themselves and their organizations to license and security risks.

Keenan Szulik leads a deep dive into selecting the right open source package, which is not always a straightforward process. It can often be time consuming, tedious, and error prone. You’ll learn how to simplify, streamline, and strengthen the process through identification, or how to get visibility into essential information on millions of open source packages; resolution, or what to do when an issue with a dependency is discovered; and prevention, or developing a repeatable process for ongoing maintenance as your team and stack evolve.

The urgency around improving package vetting becomes clear when you stop to consider just how many open source packages go into a modern application. For instance, while Facebook maintains top-level React packages, the framework depends on over 1,000 discrete open source packages and libraries. That’s 1,000 potential attack vectors, 1,000 potential license issues, and 1,000 packages whose creators may move on to other things, leaving users literally holding the bag.

It turns out that roughly 20 percent of dependencies in boilerplate React, Angular, and Vue applications, for example, go unmaintained. And no less than 80 percent of maintained packages have no vulnerability disclosure policy, and therefore no mechanism to receive bug reports and address them.