# OpenSSF Scorecard: On the Path Toward Ecosystem-wide Automated Security Metrics

arXiv: https://arxiv.org/abs/2208.03412 · HTML: https://mlsanity.com/paper/2208.03412/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Aug 2022.

## Built on by (most cited first, 5 of 5)

- [LibVulnWatch: A Deep Assessment Agent System and Leaderboard for Uncovering Hidden Vulnerabilities in Open-Source AI Libraries](https://mlsanity.com/paper/2505.08842/) (2025)
- [An LLM-based Quantitative Framework for Evaluating High-Stealthy Backdoor Risks in OSS Supply Chains](https://mlsanity.com/paper/2511.13341/) (2025)
- [Assumptions to Evidence: Evaluating Security Practices Adoption and Their Impact on Outcomes in the npm Ecosystem](https://mlsanity.com/paper/2504.14026/) (2025)
- [Which Is Better For Reducing Outdated and Vulnerable Dependencies: Pinning or Floating?](https://mlsanity.com/paper/2510.08609/) (2025)
- [Do AI Coding Assistants Check Before They Install? A Pre-Registered Demand-Side Audit of Trust Signals in the Research Software Supply Chain](https://mlsanity.com/paper/2609.07754/) (2026)

## Abstract (arXiv)

The OpenSSF Scorecard project is an automated tool to monitor the security health of open-source software. This study evaluates the applicability of the Scorecard tool and compares the security practices and gaps in the npm and PyPI ecosystems.