supply-chain-risk-auditor

To audit dependencies for supply chain security risks, you can run an automated assessment that evaluates factors like single maintainers, unmaintained status, low popularity, and past CVEs. This generates a report highlighting high-risk dependencies.

A dependency is flagged as high-risk in a software supply chain when it exhibits vulnerabilities such as single maintainer status, unmaintained code, low popularity, high-risk features, past CVEs, or an absence of a security contact.

You can identify unmaintained dependencies before a security audit by running an automated risk evaluation tool. It checks for unmaintained status, single maintainers, and missing security contacts, generating a summary report of vulnerable packages.

Yes, you need the gh tool installed and authenticated to perform a dependency risk assessment. The audit requires gh to query GitHub data for evaluating risk factors like maintainer status, popularity, and past CVEs.

Yes, you can generate a vulnerability report for dependencies with single maintainers. The assessment specifically evaluates maintainer count along with unmaintained status and past CVEs to produce a report on high-risk dependencies.