The Policies of Programming Language Ecosystems: A "Qualitative" Analysis

What it is

A October 2026 arXiv paper (cs.SE) by Jukka Ruohonen, Rahime Yilmaz and Krzysztof Sierszecki (University of Southern Denmark). It codes the written policies of eight package ecosystems against a protocol of 38 categories: PyPI, CRAN, npm, crates.io, Hex, NuGet, pub.dev and RubyGems. The ecosystems were chosen for their presence in the OSV database. Maven, Go Packages, Hackage, Swift Package Index and Packagist were dropped because they publish no comparable written policy. The paper notes Packagist's maintainers are working on malware issues without a published policy yet.

What the coding found

Majority votes across the three coders give these results:

• Four categories appear in all eight policies: property rights (copyright, trademark, licenses), malware, actions causing network unavailability, and content removal.
• Typosquatting is prohibited in only one policy. Name squatting appears in six.
• Advertising and phishing are explicitly prohibited in 50% of the policies.
• No policy covers all 38 categories. RubyGems, crates.io, npm and PyPI are the most comprehensive. CRAN is the least, covering about 39% of what RubyGems covers.
• Violence, spam, account suspension and termination, non-software uploads and sexual content are common but not universal.
• The three authors rated policy clarity at a mean of 7.3 out of 10 (10 is unambiguous), so most policies are readable.

Method

The first author built the protocol inductively. The other two coded each policy blind, without talking to each other. Agreement is reported as Fleiss' kappa and percent agreement (Pearson correlation 0.86 between the two). Convergence between ecosystems is measured by majority vote.

Caveats

• Mean and median kappa are only "moderate". Perfect agreement occurred in five categories: content removal, account suspension, account termination, property rights and binaries.
• The weakest agreement was on packaging violations, reporting of account compromise, web crawling, package size limits, mandatory contact details, obfuscation and typosquatting. The authors find no pattern explaining which categories are contested.
• Kappa and percent agreement can disagree sharply. Malware had a negative kappa but 87.5% agreement, because policies often cover malware only implicitly. NuGet's wording on material that could "harm or disrupt another user's computer" is the example given.
• The typosquatting figure comes from a category the coders disagreed on, so it is a weak basis for claims about any one ecosystem.
• The paper analyses what policies say, not how they are enforced. The fetched text stops partway through the convergence results, so the discussion section is not covered here.