Trusty provides a free-to-use service with scoring and metrics about a package’s repo and author activity.
Minder is an open source platform that helps project owners build more secure software and prove that what they’ve built is secure.
Knowing whether an open source package is being actively maintained before you import it into your code is key for avoiding rework and quality issues down the road. Here’s how Trusty’s activity score can help.
Last week, we announced the launch of Trusty, a free-to-use service that helps developers make safer dependency choices. Trusty uses statistical analysis of dimensions like author and repo activity, along with a package’s source of origin, to help you understand whether an open source package is actively maintained and not malicious.
In this post, we’ll walk you through how to use Trusty’s activity scoring to get a faster signal on a package’s repo and author activity. and make a more informed decision about whether to use that package.
Let’s say you’re working on a Python project, and you need a library to handle oauth authentication. Your first step might be to go search in Google for “Python oauth library,” and pick one of the first search results. For example, you might click on “python-oauth2” link that shows up second in the search results below, since you can see that’s coming from the PyPI repo:
But when you click through to install the package from PyPI, you might not notice that the latest version is actually from 2019:
Worse yet, many developers using AI coding tools are often bringing in dependencies without even this level of inspection, with many of the underlying models being trained on data that is at least a few years old.
If you’re using Visual Studio Code as your IDE, you can install the Trusty extension to get a quick signal on whether an external dependency is risky, right when you’re importing the library into your code. This can help you flag potentially unmaintained libraries and proactively avoid installing them.
In the example below, the Trusty extension has already been installed in VS Code. You can see that when you import the “oauth2” package, Trusty underlines this package, showing that it has a low Trusty Score and and warning you that there could be a security risk:
Clicking on the “Visit for details” link takes you to the Trusty web app, where you can view more information about the oauth2 package, and see the full scoring breakdown. You can see in the screenshot below that python-oauth2 has a Trusty Score of 4.8, and a particularly low repo activity score of 3.3. This scoring indicates that there’s a low level of open issues, recent commits, and forks, among other factors, signaling that it could be risky to take a dependency on this library.
In this case, we can see from the description and Trusty's "Deprecated" flag that the package is unmaintained, which explains why the repo activity score is low. The author activity score here is higher though, which indicates that the package author has a significant number of followers and may be actively contributing to other projects, but not this one.
In cases like this in which a package has a low Trusty Score, you can use Trusty’s Alternative Packages feature to find a less-risky alternative:
Trusty’s scoring model is based on repo and author activity, and uses statistics and Principal Component Analysis as a mechanism to assess the relative activity rating of a given package versus other open source packages. Our model retrieves public metadata on “features” of the repository and “features” of the top maintainers and committers to a project, and ranks a package in the context of how these features compare to other packages.
Here are the types of features that we currently take into account for repo and author activity scoring:
Features taken into account for repo activity scoring:
Features taken into account for author activity scoring:
The number of public repos someone contributes to
Public gists submitted
This scoring approach helps us identify whether there is an active community around an open source package. While we can’t say for sure whether a package with a higher Trusty Score will still be maintained in a year, our scoring can give you a much better signal as to whether it will be. (Read more about how our scoring works here.)
Trusty is an experimental service, and we’ll continue to make improvements to our scoring and add new features based on community feedback. A few features that are next on our roadmap include:
New scoring dimensions and risk flags: Beyond activity scoring, we plan to introduce additional scoring factors such as security and transitive dependencies. We also plan to bring in additional risk flags such as frequency of releases.
Expanding supported languages: Working with the community, we are driving efforts to include provenance information for Python and Rust packages, and also plan to expand Trusty to include Java and Go packages (among others).
Additional metadata and context: We plan to show known vulnerabilities for packages as well as license information, and also will provide more context on why a package received a specific score.