OS3: A Shift-Left Framework for Pre-Installation Risk Assessment in Open-Source npm Package Dependencies

Abstract

Most software composition analysis (SCA) tools evaluate open-source packages only after they are already installed, by which point a compromised dependency has already reached the codebase. This paper presents OS3, a prototype that shifts this assessment earlier: it resolves an npm package's full dependency tree, checks every node against the Open Source Vulnerability (OSV) database, and uses a NetworkX-based graph to trace which vulnerabilities are actually reachable from the root package rather than isolated in unused branches. These signals feed a fully specified scoring formula, with no black-box model and no external exploit-likelihood feed, that produces a 0-100 score and a four-tier risk classification a developer can recompute by hand. OS3 is implemented as a PyPI CLI, a web dashboard, and a REST API, with a separate RAG-based assistant for explaining results in natural language. Each pipeline stage was functionally validated end-to-end on representative npm packages; large-scale comparative benchmarking against existing SCA tools was not performed and is identified as future work.