supply-chain-risk-auditor

To audit dependencies for supply chain risks, systematically evaluate maintainer activity, project health, and security posture to identify packages with elevated risks of exploitation or takeover before starting a security audit.

Dependency risk assessment evaluates criteria including maintainer count, maintenance status, popularity, high-risk features, past CVEs, and security contact availability to determine if an open source package poses a supply chain threat.

Yes, you need the 'gh' tool installed to perform vulnerability management with this approach, because it is required for retrieving GitHub repository data used to evaluate project health and maintainer activity.

You need to scope dependencies for a supply chain security assessment before starting a new project audit, allowing you to quickly identify which specific packages might pose the biggest risks of exploitation or maintainer takeover.

Yes, you can generate a detailed risk report suggesting alternatives for high-risk dependencies. The report highlights packages with poor security posture and recommends safer replacements to secure your software supply chain.