Thanh-Cong Nguyen, Ngoc-Thanh Nguyen, Van-Giau Ung
et al.
Recently, the number of malicious open-source packages in package repositories has been increasing dramatically. While major security scanners focus on identifying known Common Vulnerabilities and Exposures (CVEs) in open-source packages, there are very few studies on detecting malicious packages. Malicious open-source package detection typically requires static, dynamic analysis, or both. Dynamic analysis is more effective as it can expose a package's behaviors at runtime. However, current dynamic analysis tools (e.g., ossf's package-analysis) lack an automatic method to differentiate malicious packages from benign packages. In this paper, we propose an approach to extract the features from dynamic analysis (e.g., executed commands) and leverage machine learning techniques to automatically classify packages as benign or malicious. Our evaluation of nearly 2000 packages on npm shows that the machine learning classifier achieves an AUC of 0.91 with a false positive rate of nearly 0%.
Łukasz Chrostowski, Piotr Chlebicki, Maciej Beręsewicz
The following paper presents nonprobsvy -- an R package for inference based on non-probability samples. The package implements various approaches that can be categorized into three groups: prediction-based approach, inverse probability weighting and doubly robust approach. In the package, we assume the existence of either population-level data or probability-based population information and leverage the survey package for inference. The package implements both analytical and bootstrap variance estimation for the proposed estimators. In the paper we present the theory behind the package, its functionalities and case study that showcases the usage of the package. The package is aimed at scientists and researchers who would like to use non-probability samples (e.g.big data, opt-in web panels, social media) to accurately estimate population characteristics.
Yogya Gamage, Deepika Tiwari, Martin Monperrus
et al.
Software developers reuse third-party packages that are hosted in package registries. At build time, a package manager resolves and fetches the direct and indirect dependencies of a project. Most package managers also generate a lockfile, which records the exact set of resolved dependency versions. Lockfiles are used to reduce build times; to verify the integrity of resolved packages; and to support build reproducibility across environments and time. Despite these beneficial features, developers often struggle with their maintenance, usage, and interpretation. In this study, we unveil the major challenges related to lockfiles, such that future researchers and engineers can address them. We perform the first comprehensive study of lockfiles across 7 popular package managers, npm, pnpm, Cargo, Poetry, Pipenv, Gradle, and Go. First, we highlight the wide variety of design decisions that package managers make, regarding the generation process as well as the content of lockfiles. Next, we conduct a qualitative analysis based on semi-structured interviews with 15 developers. We capture first-hand insights about the benefits that developers perceive in lockfiles, as well as the challenges they face to manage these files. Following these observations, we make 5 recommendations to further improve lockfiles, for a better developer experience.
Packaged quantum states are gauge-invariant states in which all internal quantum numbers (IQNs) form an inseparable block. This feature gives rise to novel packaged entanglements that encompass all IQNs, which is important both for fundamental physics and for quantum technology. Here we develop a framework for gauge-invariant quantum information processing based on packaged quantum states. We propose the necessary and sufficient conditions for a valid packaged superposition state of a single particle and multi-particle. We then present the details of constructing gauge-invariant packaged qubits (or qudits), packaged gates, and packaged circuits (which commute with the total charge operator). These serve as alternative foundation for gauge-invariant quantum information science. We then adapt conventional quantum error-correction codes, quantum algorithms, and quantum communication protocols to the ($d \times D$)-dimensional hybrid-packaged subspace. This high-dimensional hybrid-packaged subspace is flexible for pruning and scaling to match available physics systems. Thus, packaged quantum information processing becomes feasible and testable. Our results show that the gauge-invariant packaged quantum states may provide a possible route toward robust, fault-tolerant, and secure quantum technologies.
Food hydrocolloids are among the most popular ingredients in the food industry. They act as thickeners, gelling agents, emulsifiers, stabilizers, fat replacers, clarifying agents, flocculants, and foaming agents. In addition, these compounds are widely used in additive technologies, for production of biodegradable packaging and for encapsulation of biologically active substances, colorants and flavors. Depending on the source, food hydrocolloids are divided into four main categories: hydrocolloids of plant origin, hydrocolloids of animal origin, hydrocolloids of microbial origin, and chemically modified hydrocolloids of plant origin (synthetic gums). This review focuses on current trends and technological advances in the use of hydrocolloids to provide the required consumer properties of various food products. New research shows that some food hydrocolloids can significantly change the composition and structure of the intestinal microbiota and positively affect human health due to their physicochemical and structural properties. As hydrocolloids are increasingly used in various industries, this review on their functionality and nutritional value in food products may be of interest to researchers in developing innovative technological solutions. Given the significant achievements and rapid development of research in recent years, it can be predicted that the study of food hydrocolloids will be actively continued. The main areas will be: managing their interaction with food components, creating functional food matrices, studying the effect on cellular processes and the body as a whole, as well as assessing in vivo metabolism and safety.
Background: Japanese pharmacists aim to improve efficiency and communication by simplifying work processes and developing protocols. While assistants and robots have been shown to improve drug dispensing, reports on the efficiency of pharmacies with automated dispensing systems are limited. This study explores factors affecting pharmacist efficiency in dispensing. Methods: 77Daily reports from our hospital pharmacy (December 1, 2020–November 30, 2021) were retrospectively analyzed. The primary outcome was the mean duration of drug dispensing. Multiple regression analyses identified factors affecting dispensing time. Strategies to address these factors were implemented, and outcomes were evaluated using data from December 1, 2021–November 30, 2022. Results: Univariate analysis identified that the prescription/pharmacist ratio, number of one-dose package (ODP) prescriptions, and powdered drugs significantly influenced dispensing time. Multivariate analysis confirmed that the prescription/pharmacist ratio (p < 0.001), ODP prescriptions (p < 0.001), and powdered drugs (p = 0.02) were key factors. A higher number of ODP prescriptions generally increased dispensing time. After implementing a new strategy for checking ODP, mean dispensing time decreased from 20.0 ± 4.0 to 18.5 ± 3.6 min (p < 0.001), and the percentage of tasks completed in under 20 min increased from 56.3 % to 73.6 % (p < 0.001). Dispensing times were reduced without changing staffing levels by reallocating tasks. Conclusions: Optimizing the ODP verification workflow enhances dispensing efficiency without increasing pharmacist workload, highlighting the importance of prioritizing ODP prescriptions and implementing support tools for final checks, while further multicenter studies are needed to confirm these findings across diverse settings.
In this paper we propose a novel R package, called rsurv, developed for general survival data simulation purposes. The package is built under a new approach to simulate survival data that depends heavily on the use of dplyr verbs. The proposed package allows simulations of survival data from a wide range of regression models, including accelerated failure time (AFT), proportional hazards (PH), proportional odds (PO), accelerated hazard (AH), Yang and Prentice (YP), and extended hazard (EH) models. The package rsurv also stands out by its ability to generate survival data from an unlimited number of baseline distributions provided that an implementation of the quantile function of the chosen baseline distribution is available in R. Another nice feature of the package rsurv lies in the fact that linear predictors are specified using R formulas, facilitating the inclusion of categorical variables, interaction terms and offset variables. The functions implemented in the package rsurv can also be employed to simulate survival data with more complex structures, such as survival data with different types of censoring mechanisms, survival data with cure fraction, survival data with random effects (frailties), multivarite survival data, and competing risks survival data.
Jukka Ruohonen, Mubashrah Saddiqa, Krzysztof Sierszecki
Static analysis is a classical technique for improving software security and software quality in general. Fairly recently, a new static analyzer was implemented in the GNU Compiler Collection (GCC). The present paper uses the GCC's analyzer to empirically examine popular Linux packages. The dataset used is based on those packages in the Gentoo Linux distribution that are either written in C or contain C code. In total, 3,538 such packages are covered. According to the results, uninitialized variables and NULL pointer dereference issues are the most common problems according to the analyzer. Classical memory management issues are relatively rare. The warnings also follow a long-tailed probability distribution across the packages; a few packages are highly warning-prone, whereas no warnings are present for as much as 89% of the packages. Furthermore, the warnings do not vary across different application domains. With these results, the paper contributes to the domain of large-scale empirical research on software quality and security. In addition, a discussion is presented about practical implications of the results.
Open-source software (OSS) plays a crucial role in modern software development. Utilizing OSS code can greatly accelerate software development, reduce redundancy, and enhance reliability. Python, a widely adopted programming language, is renowned for its extensive and diverse third-party package ecosystem. However, a significant number of OSS packages within the Python ecosystem are in poor maintenance, leading to potential risks in functionality and security. Consequently, it is essential to establish a deprecation mechanism to assist package developers and users in managing packages effectively. To facilitate the establishment of the package-level deprecation mechanism, this paper presents a mixed-method empirical study, including data analysis and surveys. We investigate the current practices of announcing, receiving, and handling package-level deprecation in the Python ecosystem. We also assess the benefits of having deprecation announcements for inactively maintained packages. Furthermore, we investigate the challenges faced by package developers and users and their expectations for future deprecation practices. Our findings reveal that 75.4% of inactive package developers have no intention of releasing deprecation declarations for various reasons, while 89.5% of users express a desire to be notified about the deprecation, highlighting a gap between developers and users; in many cases, no alternative solutions are available when deprecation occurs, emphasizing the need to explore practical approaches that enable seamless package handover and require less maintenance effort. Our work aims to enhance the understanding of existing package-level deprecation patterns within the Python OSS realm and facilitate the development of deprecation practices for the Python community in the future.
Nicole Mélanie Falla, Negin Seif Zadeh, Stefania Stelluti
et al.
Edible flowers are becoming increasingly popular as food products, since they give aroma, color, and visual appeal and are also health-promoting compounds. However, they are a highly perishable product, thus post-harvest technologies are needed to extend their marketability. In this study, active (N<sub>2</sub>: 100%) and passive modified atmosphere packaging (MAP) technologies were applied to three edible flower species, namely <i>Begonia grandiflora</i> ‘Viking’, <i>Tropaeolum majus</i>, and <i>Viola cornuta</i>, stored at 4 °C. Even if the flowers’ quality decay occurred differently according to the species, active MAP better maintained petal colors and slowed down the edible flowers’ decay than passive MAP by decreasing flower respiration in all three species and sugars consumption in begonia; there was weight loss in nasturtium, and better preserved total phenolic content in begonia and viola. Coupling cold storage with active MAP can be an effective method to extend edible flowers’ post-harvest life.
Barbara Sionek, Aleksandra Szydłowska, Danuta Kołożyn-Krajewska
The increase in the nutritional awareness of consumers has meant that products with high nutritional value, sensory attractiveness, and safety are currently being sought on the market. One of the aspects in which the innovativeness of a food product can be considered is the preservation method. Fermentation is considered one of the oldest methods. In practice, biopreservation is primarily a method of using non-pathogenic microorganisms and/or their metabolites to increase microbiological safety and extend food shelf life. Advances in microbiology and genetic engineering, taking into account various sources of microbiota isolation, have rediscovered the fermentation process and allowed us to obtain innovative functional products. Recently, bacteriocins have gained importance. For many years, they have been applied as biopreservatives in food manufacturing, alone or in combination with other preservatives. The most promising perspective of food preservation seems to be the development of combined systems including natural preservatives (i.e., bacteriocin and lipopeptides), emerging non-thermal technologies, and other methods such as encapsulation nanotechnology and active packaging. In this paper, a narrative review is presented to analyze the most recently published literature regarding the role of microorganisms and microbial produced antibacterial compounds in food biopreservation. New biopreservation technologies as an alternative to artificial preservatives were also discussed.