supply-chain-risk-auditor

To check dependencies for supply chain risk, audit your project to identify third-party libraries with heightened exploitation or takeover likelihood. The audit evaluates maintainer concentration, maintenance status, popularity signals, dangerous features, past CVEs, and missing security contacts.

A dependency poses a high supply chain takeover risk when it exhibits single-maintainer concentration, lacks active maintenance, shows low popularity, contains dangerous features, has past CVEs, or lacks a designated security contact.

Yes, you need the gh command-line tool installed to accurately retrieve repository metrics during a dependency health review. The supply chain audit relies on gh to gather data for evaluating maintenance status and popularity signals.

To generate a vulnerability report for risky dependencies before active scanning, run a pre-engagement supply chain scoping assessment. This produces a structured report listing high-risk dependencies and the specific criteria that triggered each flag.

Yes, following a security posture assessment, you receive post-audit remediation guidance that recommends more popular and better-maintained alternative dependencies, including a short justification for each suggested replacement.