Dependency risk assessment

Judges a new dependency beyond known CVEs: maintenance, project security practices and signs of a malicious package.

V1018 technique

not detectable from CI configuration

Sub-techniques

ID	Name	Description
`V1018.001`	Project health scoring	Score a dependency's repository practices (branch protection, signed releases, CI).
`V1018.002`	Malicious package heuristics	Scan package contents for install-time scripts, obfuscation and exfiltration.

Run the scan only when a dependency is added or its source changes.
Require a reviewer sign-off below a score threshold rather than failing outright.

Signs that a codebase already runs this technique, and where to read how it is configured.