OS3: A Shift-Left Framework for Pre-Installation Risk Assessment in Open-Source npm Package Dependencies
Most software composition analysis (SCA) tools evaluate open-source packages only after they are already installed, by which point a compromised dependency has already reached the codebase. This paper presents OS3, a prototype that shifts this assessment earlier: it resolves an npm package's full dependency tree, check...