ESEIW 2025
Sun 28 September - Fri 3 October 2025

Widespread use of third-party libraries makes ecosystems like Node Package Manager (npm) critical to modern software development. However, this interconnectedness chain of dependent libraries introduces challenges, as bugs can propagate downstream, sometimes affecting countless libraries that depend on a library. We hypothesize that maintainers may not always decide to fix a bug, especially if the maintainer decides it falls out of their responsibility within the chain of dependencies (upstream or downstream). To confirm this hypothesis, we investigate the responsiveness of 30,340 bug reports across 500 of the most depended-upon npm packages. We adopt a mixed-method approach to mine repository issue data and perform qualitative open coding to analyze reasons behind unaddressed bug reports. Our findings show that maintainers are generally responsive, with a median project-level responsiveness of 70% (IQR: 55%–89%), reflecting a strong commitment to supporting downstream developers. We present a taxonomy of the reasons some bugs remain unresolved. The taxonomy included contribution practices, dependency constraints, and library-specific standards as reasons for not being responsive. Understanding maintainer behavior can inform practices that promote a more robust and responsive open-source ecosystem that benefit the entire community.