<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-open-source-risk-scoring
description: >-
  Perform risk scoring of open-source dependencies using project health
  metrics, maintainer reputation, vulnerability history, and community
  activity to quantify supply chain risk for each component.
domain: cybersecurity
subdomain: supply-chain-security
tags:
  - risk-scoring
  - open-source-risk
  - project-health
  - maintainer-trust
  - scorecard
  - dependency-risk
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Performing Open Source Risk Scoring

## Overview

Open-source risk scoring quantifies the supply chain risk of each dependency
using objective metrics: project activity, maintainer diversity, vulnerability
history, code review practices, CI/CD security, and community health. This
enables risk-based dependency selection and prioritized security investment
in the components that matter most to your software supply chain.

Mode: `[MODE: BLUE]` — Quantify open-source dependency risk with multi-factor scoring.

## Prerequisites

| Requirement | Details |
|---|---|
| OpenSSF Scorecard CLI (`brew install scorecard`) | Required |
| curl for API access (deps.dev, libraries.io) | Required |
| jq for JSON processing | Required |
| git for repository analysis | Required |
| Python 3.10+ with `requests` | Required |

## Key Concepts

### OpenSSF Scorecard Analysis

```bash
# Run Scorecard against a repository
scorecard --repo=github.com/expressjs/express --format json | jq '{
  score: .score,
  checks: [.checks[] | {name, score, reason}]
}'

# Check specific criteria
scorecard --repo=github.com/owner/repo --checks=Vulnerabilities,Maintained,Code-Review --format json

# Batch score multiple repositories
for repo in expressjs/express lodash/lodash; do
  echo "=== $repo ==="
  scorecard --repo="github.com/$repo" --format json | jq '{repo: .repo.name, score: .score}'
done
```

### Project Health Metrics

```bash
# Query deps.dev for dependency health
curl -s "https://api.deps.dev/v3alpha/systems/npm/packages/express" | jq '{
  versions: (.versions | length),
  latest: .versions[-1].versionKey.version
}'

# GitHub repository activity
gh api repos/expressjs/express --jq '{
  stars: .stargazers_count,
  forks: .forks_count,
  open_issues: .open_issues_count,
  last_push: .pushed_at,
  archived: .archived
}'

# Commit frequency (last 90 days)
gh api "repos/owner/repo/stats/commit_activity" --jq '[.[] | .total] | add'
```

### Vulnerability History Analysis

```bash
# Query OSV for vulnerability history
curl -s -X POST "https://api.osv.dev/v1/query" \
  -H "Content-Type: application/json" \
  -d '{"package":{"name":"express","ecosystem":"npm"}}' | jq '{
  total_vulns: (.vulns | length),
  recent: [.vulns[] | select(.published > "2024-01-01") | .id]
}'

# Check GitHub Security Advisories
gh api "repos/owner/repo/security-advisories" --jq '[.[] | {severity, summary, published_at}]'
```

## Workflow

### Step 1: Calculate risk score for a dependency

```bash
node scripts/agent.js --action score --manifest /tmp/target --output /tmp/score-result.json
```

### Step 2: Compare risk scores across alternatives

```bash
node scripts/agent.js --action compare --manifest /tmp/target --output /tmp/compare-result.json
```

### Step 3: Generate open-source risk scoring report

```bash
node scripts/agent.js --action report --manifest /tmp/target --output /tmp/report-result.json
```

## Detection

```yaml
title: Open Source Risk Scoring Detection
id: b853c429-f5ab-43c6-b57e-65c1f253209f
status: experimental
description: Detects suspicious activity related to performing open source risk scoring techniques in supply chain security context
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine: "*performing*open*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.initial_access
falsepositives:
  - Package manager performing routine dependency resolution
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Open Source Risk Scoring Detection | linux/process_creation | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All critical dependencies scored above minimum threshold
- [ ] High-risk dependencies documented with compensating controls
- [ ] Maintainer diversity assessed for bus-factor risk
- [ ] Vulnerability history reviewed for recurring patterns
- [ ] OpenSSF Scorecard checks pass for critical dependencies

## References

- [OpenSSF Scorecard](https://securityscorecards.dev/)
- [deps.dev](https://deps.dev/)
- [CHAOSS Metrics](https://chaoss.community/metrics/)
- [OSV Database](https://osv.dev/)
