Beyond One-Hop Aliases: Measuring Identifier-Resolution Fragmentation in the OSV Vulnerability Graph Across Six Package Ecosystems
Keywords:
OSV, vulnerability identifiers, alias resolution, vulnerability databases, software supply chain, graph analysisAbstract
Background: Open-source vulnerability records connect source-native identifiers through aliases. The Open Source Vulnerability (OSV) specification treats aliases as symmetric and transitive, but consumers that stop at one record's directly listed identifiers may recover an incomplete equivalence set.
Objective: This study measures the difference between direct alias lists and transitive closure in a frozen, cross-ecosystem OSV snapshot.
Methods: We acquired the official OSV archives for PyPI, npm, Maven, Go, crates.io, and RubyGems on 1 October 2026. A deterministic, test-driven pipeline deduplicated records, built an undirected alias graph, and measured closure completeness, explicit reciprocity, package and ecosystem breadth, and publication span. A sensitivity analysis added related links as weak associations without treating them as equality claims.
Results: The corpus contained 280,270 unique records, 345,225 identifier nodes, 94,492 alias edges, and 267,681 components. Transitive alias debt affected 334 records (0.119%), or 0.463% of records in non-singleton components. Explicit record-to-record declarations were reciprocal in 28,740 of 28,858 cases (99.591%). Debt occurred in 101 components. One 361-node component accounted for 180 debt-bearing records; excluding it reduced prevalence to 0.055%. Adding related edges merged 276 components and increased the largest component from 361 to 1,556 nodes.
Conclusions: OSV aliases were highly reciprocal and usually sufficient for one-hop resolution, but a small, concentrated set of components required closure. Consumers should implement typed graph traversal, preserve provenance, and keep alias equality separate from weaker relatedness.
References
Open Source Security Foundation. Open Source Vulnerability format: schema specification. Versioned source commit 65280faa676c7a69bb9208d876b2419f88dd7e03. 2026. https://ossf.github.io/osv-schema/
Open Source Vulnerabilities. Data sources and per-ecosystem data dumps. 2026. https://google.github.io/osv.dev/data/
Y. Dong, W. Guo, Y. Chen, X. Xing, Y. Zhang, and G. Wang. Towards the Detection of Inconsistencies in Public Security Vulnerability Reports. In: 28th USENIX Security Symposium, pp. 869–885, 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/dong
A. Anwar, A. Abusnaina, S. Chen, F. Li, and D. Mohaisen. Cleaning the NVD: Comprehensive Quality Assessment, Improvements, and Analyses. IEEE Transactions on Dependable and Secure Computing 19(6), 4255–4269, 2022. https://doi.org/10.1109/TDSC.2021.3125270
Y. Jiang, M. Jeusfeld, and J. Ding. Evaluating the Data Inconsistency of Open-Source Vulnerability Repositories. In: Proceedings of the 16th International Conference on Availability, Reliability and Security, 2021. https://doi.org/10.1145/3465481.3470093
R. Croft, M. A. Babar, and M. M. Kholoosi. Data Quality for Software Vulnerability Datasets. In: 45th IEEE/ACM International Conference on Software Engineering, 2023. https://doi.org/10.1109/ICSE48619.2023.00022
B. Boles, C. Izurieta, and A. M. Reinhold. Connecting the Dots: An Integrated Vulnerability Knowledge Graph for Security Practitioners. In: 2025 IEEE International Conference on Information Reuse and Integration and Data Science, 2025. https://doi.org/10.1109/IRI66576.2025.00050
J. Wunder, A. Corona, A. Hammer, and Z. Benenson. On NVD Users’ Attitudes, Experiences, Hopes, and Hurdles. Digital Threats: Research and Practice 5(3), 1–19, 2024. https://doi.org/10.1145/3688806
Downloads
Published
Issue
Section
License
Copyright (c) 2026 AlphaTech Systems LLC
This work is licensed under a Creative Commons Attribution 4.0 International License.
AlphaTech Systems LLC publishes the version of record under the Creative Commons Attribution 4.0 International licence (CC BY 4.0), permitting sharing and adaptation for any purpose with appropriate attribution, a link to the licence, and an indication of changes. The public licence applies upon publication and is irrevocable for compliant users; submission alone does not license unpublished material.
