OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics

Brian Hambleton; Laurie Williams; Nusrat Zahan; Parth Kanakiya; Shohanuzzaman Shohan

OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2208.03412 v4 pith:O7PEZOBA submitted 2022-08-06 cs.CR

Nusrat Zahan , Parth Kanakiya , Brian Hambleton , Shohanuzzaman Shohan , Laurie Williams This is my paper · ORCID

classification cs.CR

keywords scorecardsecurityautomatedopenssftoolapplicabilitycomparesecosystem-wide

verification ladder T0 review T1 audit T2 compute T3 formal

0 comments

read the original abstract

The OpenSSF Scorecard project is an automated tool to monitor the security health of open-source software. This study evaluates the applicability of the Scorecard tool and compares the security practices and gaps in the npm and PyPI ecosystems.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

Tracing Vulnerabilities in Maven: A Study of CVE lifecycles and Dependency Networks
cs.SE 2025-02 conditional novelty 5.0 of 10

Maven maintainers patch critical vulnerabilities about 48% faster than low-severity ones after public disclosure, and dependent packages take a median of 151 days to adopt available fixes.

Pith tools