Assessing NuGet Packages more easily with Security Scorecards
summary
OpenSSF Scorecards runs automated checks and rates projects 0–10 so maintainability and build risks become measurable; the CLI and dev.dev API already embed scores for millions of repos (weekly scans across ~1M projects) and show real results like Newtonsoft.Json 3.4/10. Industry data shows ~79% of libraries rarely get updates and ~32% are end‑of‑life, so the talk demonstrates using the scorecard CLI, dev.dev package metadata, and tooling ideas (IL reproducibility checks, SharpFuzz for .NET fuzzing) to triage NuGet risk.
AI-written summary · about
chapters (7)
- 0:00Introduction and supply chain risks
- 2:48OpenSSF scorecard overview
- 12:39Scorecard automated checks
- 27:59CLI and API demonstration
- 33:31Tooling and future improvements
- 37:54Advanced security enhancements
- 51:09Conclusion and Q&A
related talks
57mReviewing NuGet Packages security easily using OpenSSF Scorecard
59mReviewing NuGet Packages security easily using OpenSSF Scorecard
48mAssessing 3rd Party Libraries More Easily With Security Scorecards
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
31mScorecard at Scale: Old and New Possibilities for Lifting Security on All Repositories
16mFortify Your Code: Secure Your Supply Chain with Scorecard
27mHow Do You Trust Your Open Source Software?
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard