SCA - Software Composition Analysis

Path: /code/sca · Sidebar: Testing → Code Security → SCA

SCA inspects your third-party dependencies for known vulnerabilities, malicious packages and license risk across ecosystems (pip, npm, Maven, Go modules, Gemfile, and more).

What it checks

• Known vulnerabilities (CVEs) in your direct and transitive dependencies, enriched with advisories (NVD, GHSA, OSV).
• Reachability - whether the vulnerable function is actually called from your code, so you can deprioritise unreachable CVEs.
• Malicious packages - typosquats and known-bad packages.
• License compliance - flags licenses that violate your policy.

Run an SCA scan

1. From Repositories, choose Scan on a repo/product.
2. apPosture parses the lockfiles/manifests and resolves the dependency tree.
3. Findings land here and in Vulnerabilities, enriched with EPSS and KEV signals.

Reading an SCA finding

• Package & version, the fixed version to upgrade to, and the dependency path (direct vs. transitive).
• Advisory details, CVSS, EPSS score and KEV flag.
• Reachability verdict where computed.

Slopsquat / hallucinated-package detection

AI coding assistants routinely invent package names that do not exist. Attackers watch for these "hallucinated" names and register them - a supply-chain trap known as slopsquatting. apPosture screens every declared dependency for this class of risk (config sca_slopsquat_check):

• Missing package - a dependency that resolves to a 404 in its registry. It does not exist, so a name-collision or a future malicious registration is the only way it ever will. Reported high, kind=malicious, tagged as hallucinated (CWE-1104).
• Newborn package - a real package first published within the last 30 days. Brand-new names are a common slopsquat landing spot; flagged medium so a legitimate fresh release is reviewed rather than blocked.

Both feed the same Vulnerabilities queue as any other finding. See also AI Security, where package hygiene is one pillar of securing AI-assisted development.

The OSV feed

A curated vulnerability database ships by default. Turning on the OSV feed (OSV_ENABLED=true) augments it via opt-in egress to osv.dev for production-grade CVE breadth. In air-gapped setups, leave it off and rely on the curated DB.

Prioritise by reachability + KEV

A Critical CVE in an unreachable transitive dep is often lower real risk than a reachable Medium that's on the KEV list. Use the reachability and KEV columns to sort what to fix first - and let Priorities do it for you.