OpenSSF Scorecard: On the Path Toward Ecosystem-Wide Automated Security Metrics
Open accessAbstract
The OpenSSF Scorecard project is an automated tool to monitor the security health of open source software. This study evaluates the applicability of the Scorecard tool and compares the security practices and gaps in the npm and PyPI ecosystems.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
What are weak links in the npm supply chain?
Zahan, N., Zimmermann, T., Godefroid, P., Murphy, T. B., Maddila, C., & Williams, L. A. (2022) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1145/3510457.3513044 · Cited by 104 · see citing works
Self-citationFavocado: Fuzzing the Binding Code of JavaScript Engines Using Semantically Correct Test Cases
Dinh, S. T., Cho, H., Martin, K., et al. (2021) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2021.24224 · Cited by 47 · see citing works
Committed to Trust: A Qualitative Study on Security & Trust in Open Source Software Projects
Wermke, D., Wöhler, N., Klemmer, J. H., Fourné, M., Acar, Y., & Fahl, S. (2022) · 2022 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp46214.2022.9833686 · Cited by 42 · see citing works
Are your dependencies code reviewed?: Measuring code review coverage in dependency updatesPreprint
Imtiaz, N., & Williams, L. A. (2022) · arXiv (Cornell University) · doi:10.48550/arxiv.2206.09422
Self-citation
Flagged first, then by citations
Research works printed but not linked: 2
- [1][1] Sonatype, '700% average increase in open source supply chain attacks,' https://www.sonatype.com/press-releases/sonatype-finds-700-averageincrease-in-open-source-supply-chain-attacks , 2022. -
- [2][2] M. Souppaya et al. , 'Secure software development framework, version 1.1,' NIST Special Publication , vol. 800, p. 218, 2022. -
Cited by
Sorted by citations
He, H., Yang, H., Burckhardt, P., Kapravelos, A., Vasilescu, B., & Kästner, C. (2026) · Proceedings of the 2026 IEEE/ACM 48th International Conference on Software Engineering · doi:10.1145/3744916.3764531 · Cited by 2 · see citing works
- Authors
- Zahan, N., Kanakiya, P., Hambleton, B., Shohan, S., & Williams, L.
- Affiliations
- North Carolina State University (US)
- Amazon (United States) (US)
- Eli Lilly, New York, NY, USA
- Venue
- IEEE Security & Privacy
- Published
- 2023-11
- Volume
- 21
- Issue
- 6
- Pages
- 76-88
- ISSN
- 1540-7993 (ISSN-L)
- 1558-4046
- OpenAlex
- W4380982237
- Cited by
- 19
- References
- 4
- Citations by year
- 2026: 4 · 2025: 7 · 2024: 3 · 2023: 5
- FWCI
- 4.46
- Type
- journal article
- Language
- en
- Open access
- green
- arxiv.org
- Licence
- Locations
- IEEE Security & Privacy (publishedVersion)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University)
- Funders
- National Science Foundation (2207008)
- Topics
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Keywords
- open-source software security, security practices, security vulnerabilities, npm, PyPI, security maturity assessment
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
