  With the popularity of software ecosystems, the number of open source
components (known as packages) has grown rapidly. Identifying high-quality and
well-maintained packages from a large pool of packages to depend on is a basic
and important problem, as it is beneficial for various applications, such as
package recommendation and package search. However, no systematic and
comprehensive work focuses on addressing this problem except in online
discussions or informal literature and interviews. To fill this gap, in this
paper, we conducted a mixed qualitative and quantitative analysis to understand
how developers identify and select relevant open source packages. In
particular, we started by surveying 118 JavaScript developers from the npm
ecosystem to qualitatively understand the factors that make a package to be
highly-selected within the npm ecosystem. The survey results showed that
JavaScript developers believe that highly-selected packages are
well-documented, receive a high number of stars on GitHub, have a large number
of downloads, and do not suffer from vulnerabilities. Then, we conducted an
experiment to quantitatively validate the developers' perception of the factors
that make a highly-selected package. In this analysis, we collected and mined
historical data from 2,527 packages divided into highly-selected and not
highly-selected packages. For each package in the dataset, we collected
quantitative data to present the factors studied in the developers' survey.
Next, we used regression analysis to quantitatively investigate which of the
studied factors are the most important. Our regression analysis complements our
survey results about highly-selected packages. In particular, the results
showed that highly-selected packages tend to be correlated by the number of
downloads, stars, and how large the package's readme file is.
