Reviewing NuGet Packages security easily using OpenSSF Scorecard
summary
OpenSSF Scorecard runs automated checks and produces a 0–10 aggregate score with weighted risks; OpenSSF Scorecard gives 0–10 aggregate score. The demo shows it running against NuGet and git repos, reporting Newtonsoft.Json scores 3.1/10 and listing dangerous workflows, binary artifacts, missing CI automation and transitive vulnerabilities. A local tool called fenex/fex collects scorecards per project and saves JSON; SharpFuzz and OSV.dev are used for fuzzing and vuln lookups, reproducible-build diffs are prototyped.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 3:19Third-party package risks
- 12:08Security incidents in ecosystems
- 15:19OpenSSF Scorecard for packages
- 29:17Scorecard checks and scoring
- 31:26Live demo of Scorecard
- 36:47Fex CLI for automated analysis
- 41:02Improving Scorecard for .NET and Rust
- 45:35Reproducibility and binary analysis
- 51:17Collective security reviews
- 53:03Conclusion and Q&A
related talks
59mReviewing NuGet Packages security easily using OpenSSF Scorecard
54mAssessing NuGet Packages more easily with Security Scorecards
48mAssessing 3rd Party Libraries More Easily With Security Scorecards
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
52mBuilding Community-Driven Security Analysis for Your .NET Software Supply Chain
27mAn Open Book Test: Securing Open Source Software With OpenSSF’s Scorecard
27mHow Do You Trust Your Open Source Software?
50mHow Do You Trust Open Source Software?