Can I trust that package?
summary
A lightweight scoring system called Litmus assesses R packages by pulling metrics (license, security, code coverage, docs, maintenance, downloads, dependencies) and converting them via ECDF mapping into 0–1 scores, then combining weighted averages with configurable weights and explicit high‑risk flags. A prototype dashboard currently shows 1,000 packages and flags one known security vulnerability, with plans to ingest all CRAN soon. Practical stats reported: median 3 dependencies, 25% have one, max 49 dependencies, median codebase ~600 LOC, max ~100,000. Also available: diffify.com to diff exported functions between versions.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:23Measuring package trust
- 3:33Risk appetite
- 7:08Key metrics for quality
- 8:33Litmus package assessment
- 12:44Normalizing CRAN metrics
- 13:46Dashboard demo
- 15:53Recording decisions
- 16:13Summary and tools
- 16:59Q&A
related talks
10mLightning Talk: Scoring Dependencies to Detect “Weak Links” in your Open-source So...
48mAssessing 3rd Party Libraries More Easily With Security Scorecards
54mAssessing NuGet Packages more easily with Security Scorecards
16mFortify Your Code: Secure Your Supply Chain with Scorecard
01h 01mAutomating dependency selection with open-source tools at scale
07mA Teen’s Perspective on Navigating Open Source Security with GUAC
59mReviewing NuGet Packages security easily using OpenSSF Scorecard
57mReviewing NuGet Packages security easily using OpenSSF Scorecard