OSS Trust Intelligence

Deterministic security and supply-chain risk intelligence for exact open-source package versions.

Analyze packages from npm, PyPI, Maven, and Cargo using vulnerability, exploitability, maintenance, dependency, licensing, provenance, and project-health signals.

OSS Trust Intelligence is designed to answer a practical question:

Should I trust and adopt this exact package version?

What it analyzes

For each exact package version, the Actor can evaluate:

• Known vulnerabilities
• CVSS severity
• EPSS exploit probability
• CISA Known Exploited Vulnerabilities
• Package and project metadata
• OpenSSF Scorecard signals when available
• Maintenance and project health
• License information
• Dependency exposure
• Dependency vulnerabilities in full mode
• Provenance and source mapping signals

Results are deterministic and explainable. Missing upstream evidence lowers confidence instead of being treated as zero risk.

Supported ecosystems

Ecosystem	Quick analysis	Full dependency analysis
npm	Supported	Supported
PyPI	Supported	Supported
Maven	Supported	Supported
Cargo	Supported	Best effort / preview

Cargo package and vulnerability analysis is fully supported. Dependency graph resolution for Cargo is best effort because upstream graph data can be unavailable or incomplete for some package versions.

Analysis modes

Quick

Fast package-level security and trust analysis.

Use it when you need:

• vulnerability intelligence
• exploitability signals
• maintenance and project health
• licensing
• provenance and source mapping
• a fast trust decision

Price:

$0.005 per successfully analyzed package

Full

Includes everything from quick mode plus dependency graph analysis and dependency vulnerability assessment.

Price:

$0.03 per successfully analyzed package

If a required dependency graph cannot be reliably resolved, the result is returned as partial and the full-analysis event is not charged.

Input

The Actor requires exact package versions.

Example:

{
  "mode": "quick",
  "targets": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    }
  ]
}

Full analysis:

{
  "mode": "full",
  "targets": [
    {
      "ecosystem": "maven",
      "name": "org.apache.commons:commons-lang3",
      "version": "3.17.0"
    }
  ]
}

Batch requests are supported:

{
  "mode": "quick",
  "targets": [
    {
      "ecosystem": "npm",
      "name": "lodash",
      "version": "4.17.21"
    },
    {
      "ecosystem": "pypi",
      "name": "requests",
      "version": "2.32.3"
    }
  ]
}

Floating tags and version ranges are intentionally not supported. Analysis always targets an exact package version.

Output

Each analyzed target produces one structured dataset item.

Example:

{
  "schemaVersion": "oss.trust.analysis.v1",
  "status": "complete",
  "mode": "quick",
  "target": {
    "ecosystem": "npm",
    "name": "lodash",
    "version": "4.17.21"
  },
  "risk": {
    "score": 56,
    "level": "high",
    "recommendation": "review",
    "confidence": 1.0,
    "scoringVersion": "oss-risk-v1"
  },
  "vulnerabilities": {
    "total": 3,
    "knownExploited": 0
  }
}

Risk scores range from 0 to 100.

Higher scores mean higher observed supply-chain risk.

Recommendations are:

• accept
• review
• avoid

Partial results

OSS Trust Intelligence does not hide missing upstream evidence.

For example:

{
  "status": "partial",
  "risk": {
    "score": null,
    "level": "unknown",
    "recommendation": "review",
    "confidence": 0.65
  },
  "errors": [
    {
      "code": "GRAPH_NOT_INDEXED",
      "provider": "deps.dev",
      "message": "dependency graph is not indexed for the requested exact version"
    }
  ]
}

Important result codes include:

• GRAPH_NOT_INDEXED — upstream dependency graph is not indexed yet
• GRAPH_RESOLUTION_FAILED — upstream dependency resolver could not construct a reliable graph
• PROJECT_ENRICHMENT_UNAVAILABLE — optional project-health enrichment could not be retrieved

Graph failures are not interpreted as package vulnerabilities.

Scoring

The current scoring policy combines five dimensions:

• Vulnerability risk — 45%
• Project hygiene — 20%
• Maintenance health — 15%
• Dependency surface — 10%
• Provenance and licensing — 10%

Known exploited vulnerabilities can trigger a critical hard gate.

CVSS and EPSS are treated as different signals. The scorer uses the stronger vulnerability signal conservatively rather than averaging away high severity or high exploit probability.

Current weights and thresholds are launch policy hypotheses, not calibrated probabilities of compromise.

Data sources

The Actor combines independent public security and ecosystem signals including:

• deps.dev
• OSV
• FIRST EPSS
• CISA Known Exploited Vulnerabilities
• OpenSSF Scorecard data when available

Upstream availability and coverage can differ by ecosystem and package version.

Billing behavior

The Actor uses pay-per-event pricing.

Only successfully completed billable analyses emit paid analysis events.

Partial or failed analyses caused by missing required upstream dependency evidence are not charged as successful full analyses.

The Actor also respects the maximum cost per run configured by the user. Batch processing stops before exceeding the available event budget.

Security model

OSS Trust Intelligence analyzes public package and ecosystem metadata.

It does not install or execute analyzed package code and does not clone arbitrary repositories as part of the current analysis pipeline.

This reduces the attack surface of analyzing untrusted open-source packages.

Recommended use cases

OSS Trust Intelligence is useful for:

• dependency adoption reviews
• software supply-chain security
• CI/CD security gates
• AI agents selecting dependencies
• security research
• package portfolio review
• automated dependency trust workflows

Known limitations

Security intelligence is constrained by the freshness and coverage of upstream public data.

A low score does not prove that software is secure.

An absence of known vulnerabilities does not prove that vulnerabilities do not exist.

Cargo dependency graph analysis is currently best effort because upstream graph resolution has materially lower coverage than npm, PyPI, and Maven.

Schema stability

Current public result schema:

oss.trust.analysis.v1

Scoring policy:

oss-risk-v1

Schema and scoring versions are included in outputs so integrations can reason about future changes explicitly.