Decisions
ADR-0039: More evidence sources through Zetaris: malicious packages, project health, CVSS and licences
Status: accepted · Date: 2026-10-23
Decided by: the owner · Written by: the advisor (claude-code, claude-opus-5-5), 2026-10-23
Follows: ADR-0004 (the first sources), ADR-0023 (loaded through Zetaris), ADR-0032 (queries from templates)
Trigger: the owner, 23 October: "and other databases as sources?"
Decision
Four more sources, each loaded into Zetaris and queried from a template like the first ones:
- OpenSSF Malicious Packages (OSV entries with the
MAL-prefix): a dependency published on purpose to harm is reported as such, with the advisory's row as evidence. - Project health (OpenSSF Scorecard, through deps.dev): a newly added dependency with no maintainers, unsigned releases, or a release only days old is reported, with its scores as evidence.
- CVSS from NVD, shown beside EPSS: how severe a vulnerability is, next to how likely it is to be exploited.
- Licences (SPDX): a new dependency whose licence the organisation's policy does not allow is reported (ADR-0036).
Each source has a sample table, so sample mode covers it with no network.
Consequences
- Proven sees supply-chain attacks, not only known vulnerabilities.
- Four more tables to keep fresh; each finding states the snapshot date of its row.