Open source software (OSS) supply chains have been attractive targets for attacks. One of the significant, popular attacks is realized by malicious packages on package registries. NPM, as the largest package registry, has been recently flooded with malicious packages. In response to this severe security risk, many detection tools have been proposed. However, these tools do not model malicious behavior in a holistic way; only consider a predefined set of sensitive APIs; and require huge manual confirmation effort due to high false positives and binary detection results. Thus, their practical usefulness is hindered.

In current blockchain systems, the transaction fee is often not enough to cover the storage cost, jeopardizing blockchain sustainability in the long run. Such a storage sustainability issue is partially due to miners’ heterogeneous storage costs and users’ low-intensity fee competition. Motivated by these two observations, we propose a Fee and Transaction Expiration Time (FTET) mechanism to alleviate this issue. Specifically, we model the blockchain operation as a three-stage game. In Stage I, the system designer proposes the storage sustainability mechanism. In Stage II, each user decides whether to propose transactions and the corresponding transaction fees. In Stage III, each miner decides which transactions to include in the block. Although the analysis of the heterogeneous miner interaction is technically challenging, we fully solve it in closed-form motivated by how miners select transactions in practice. The equilibrium analysis reveals that high-storage-cost miners admit transactions with fees above a time-increasing threshold. Under the optimal FTET mechanism, the blockchain system can achieve the storage sustainability without any social welfare loss, comparing with the maximum achievable social welfare without the storage sustainability constraint. Moreover, the optimal FTET mechanism achieves a higher social welfare than the fee mechanism in current practice by selectively rejecting some transactions suffering high delays. Finally, we implement a blockchain prototype to compare the performance of the optimal FTET mechanism with the mining round time adjustment (MRTA) mechanism. The optimal FTET mechanism achieves higher social welfare (94.5% on average) and better storage sustainability. We find that more pending transactions may lead to lower transaction fees.