Awesome Reviewers

Verification · Supply chain

Dependency risk assessment

Judges a new dependency beyond known CVEs: maintenance, project security practices and signs of a malicious package.

Sub-techniques

  • Project health scoring V1018.001

    Score a dependency's repository practices (branch protection, signed releases, CI).

  • Malicious package heuristics V1018.002

    Scan package contents for install-time scripts, obfuscation and exfiltration.

How to build it

  1. Run the scan only when a dependency is added or its source changes.
  2. Require a reviewer sign-off below a score threshold rather than failing outright.

Signals in a repository

  • An ossf/scorecard-action workflow, or guarddog in CI.