MARIN: A Research-Centric Interface for Querying Software Artifacts on Maven Repositories

Maven Central is the largest open repository for JVM libraries, hosting just under 15 million artifacts as of November 2024. Its popularity has made it a prime target for malicious actors to upload malware or exploit vulnerabilities – one in eight open source downloads have been vulnerable in 2023. Consequently, analyzing the artifacts is essential to understanding and improving software security and safety, both for individual projects and on a large-scale.However, current implementations of concrete analyses do not separate the infrastructural task of iterating and accessing artifacts from their domain-specific analysis task. Consequently, features are implemented many times in different variations, increasing the potential for bugs as well as the overhead in development and maintenance.With this work we propose MARIN, a framework for conducting analyses targeting software hosted on Maven Central. MARIN handles common infrastructural tasks in such scenarios, including iterating artifacts, retrieving metadata, parsing binaries, and resolving dependencies. It is designed to have minimal performance overhead, using both internal caches and the local Maven repository to reduce the number of HTTP calls and computations. This way, researchers can solely focus on implementing their domain-specific analysis task – MARIN provides configurable facilities to execute it for all artifacts on Maven Central.