supply-chain-risk-auditor

To audit dependencies for supply-chain risks, evaluate them against criteria like single maintainer status, unmaintained code, low popularity, past CVEs, and missing security contacts. This generates a high-level risk report to outline high-risk components and plan mitigations.

A dependency is flagged as high-risk during a supply-chain audit if it has a single maintainer, is unmaintained, has low popularity, contains high-risk features, has past CVEs, or lacks a designated security contact.

Yes, you can monitor dependency health by using the gh tool to query GitHub repository metrics. This fetches accurate data on maintainer status and repository activity to enforce risk criteria for reporting.

Yes, this dependency risk assessment applies to ongoing supply-chain audits and continuous dependency health monitoring across software projects, not just pre-engagement risk assessments.

You generate a dependency health report by evaluating the project's dependencies against enforced risk criteria. This produces a summarized view of risk factors across the entire software project.

The best way to identify unmaintained dependencies threatening security is to run an automated risk audit. This flags packages lacking active maintenance or a security contact to help security teams focus remediation efforts.