OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics
Not on the map. Why?
Abstract (arXiv)
The OpenSSF Scorecard project is an automated tool to monitor the security health of open-source software. This study evaluates the applicability of the Scorecard tool and compares the security practices and gaps in the npm and PyPI ecosystems.
Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). First posted on arXiv 6 Aug 2022.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2025: 4; 2026: 1.
5 papers.
- 2025LibVulnWatch: A Deep Assessment Agent System and Leaderboard for Uncovering Hidden Vulnerabilities in Open-Source AI Librariescited by 1
- 2025An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chainscited by 1
- 2025Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystemcited by 0
- 2025Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?cited by 0
- 2026Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chaincited by 0
- 2026Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain7 Sep 2026
- 2025An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chains17 Nov 2025
- 2025Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?7 Oct 2025
- 2025LibVulnWatch: A Deep Assessment Agent System and Leaderboard for Uncovering Hidden Vulnerabilities in Open-Source AI Libraries13 May 2025
- 2025Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem18 Apr 2025