This is a really weak paper IMHO, and I would give it a strong -1 if I was a reviewer. These people are mindlessly applying the results of a static analysis to

This is a really weak paper IMHO, and I would give it a strong -1 if I was a reviewer. These people are mindlessly applying the results of a static analysis tool which, as most similar tools do, reports ginormous amounts of false positive, and conclude without even a caveat "half of the packages on PyPI have at least one security issue". That's about as useful as administering an unreliable COVID test that give 50% false positives and concluding "have of the world population has COVID".