Technique · Supply chain

Dependency risk assessment

Judges a new dependency beyond known CVEs: maintenance, project security practices and signs of a malicious package.

Sub-techniques

Project health scoring V1018.001

Score a dependency's repository practices (branch protection, signed releases, CI).
Malicious package heuristics V1018.002

Scan package contents for install-time scripts, obfuscation and exfiltration.