OSS Forensics

Purpose

• Use this skill to investigate open-source repositories, packages, images, and dependency trees for security risk.
• It is useful for package intake, third-party code review, incident response, and supply-chain due diligence.
• Treat this as a forensic and risk-triage workflow, not a single tool.

High-Level Approach

1. Audit dependencies for known vulnerabilities.
2. Assess repository trust signals and maintainer health.
3. Review code for suspicious patterns.
4. Generate an SBOM and map packages to CVEs.
5. Check history, provenance, and release integrity.

Dependency Audit

Python: