Patterns of Effort Contribution and Demand and User Classification based on Participation Patterns in NPM Ecosystem

Abstract

Background: Open source requires participation of volunteer and commercial developers (users) in order to deliver functional highquality components. Developers both contribute effort in the form of patches and demand effort from the component maintainers to resolve issues reported against it. Aim: Identify and characterize patterns of effort contribution and demand throughout the open source supply chain and investigate if and how these patterns vary with developer activity; identify different groups of developers; and predict developers' company affiliation based on their participation patterns. Method: 1,376,946 issues and pull-requests created for 4433 NPM packages with over 10,000 monthly downloads and full (public) commit activity data of the 272,142 issue creators is obtained and analyzed and dependencies on NPM packages are identified. Fuzzy c-means clustering algorithm is used to find the groups among the users based on their effort contribution and demand patterns, and Random Forest is used as the predictive modeling technique to identify their company affiliations. Result: Users contribute and demand effort primarily from packages that they depend on directly with only a tiny fraction of contributions and demand going to transitive dependencies. A significant portion of demand goes into packages outside the users' respective supply chains (constructed based on publicly visible version control data). Three and two different groups of users are observed based on the effort demand and effort contribution patterns respectively. The Random Forest model used for identifying the company affiliation of the users gives a AUC-ROC value of 0.68. Conclusion: Our results give new insights into effort demand and supply at different parts of the supply chain of the NPM ecosystem and its users and suggests the need to increase visibility further upstream. CCS CONCEPTS• Software and its engineering → Open source model; • Computing methodologies → Supervised learning by classification; Cluster analysis;

The Secret Life of Hackathon Code Where does it come from and where does it go?

“…considering code clones/snippets while looking for code reuse (e.g. by looking at the associated CTAG tokens -a dataset available in WORLD OF CODE), identifying other factors that affect code reuse, including code quality [51], [52], project popularity [53], [54], the type of Open Source license used, etc. Looking deeper into the code created during the hackathons, it might also be interesting to see to what extent the teams use bots [55], [56] which might aid in the understanding of hackathon code reuse as well.…”

Representation of Developer Expertise in Open Source Software

“…Further application of our approach might include: a) detecting if a developer is actually a bot by analyzing the concentration of their skill vector (similar to [49], [50]); b) checking the alignment between skill vectors of different developers for identity resolution (similar to [47]); c) analyzing the skill vectors of the developers in a project to infer the transparency of the corresponding software supply chain [51], [52], [53], [54], [55], [56].…”

Deriving a usage-independent software quality metric

“…[74] studies the dependency, specifically the lag in updating dependencies in various NPM packages while [1] looked into the use of trivial packages as part of package dependencies for different NPM packages. [15] investigated the factors affecting NPM package popularity, and [14] investigated the participation patterns of issue and patch creators.…”