The problem
Projects pull in dozens of packages, and a single compromised or abandoned dependency can introduce risk.
What to build
Build a checker that reads a project's dependency files and flags known vulnerabilities, suspicious packages and unmaintained libraries.
Success looks like
Flagging of seeded risky packages in a test repository with a ranked fix list and software bill of materials output.
Suggested technologies
- SBOM
- Vulnerability databases
- Dependency graphs
- CI integration
- Typosquat detection
An original, independent statement. It is not an official Smart India Hackathon problem statement, and Arventiq Labs is not affiliated with or endorsed by that programme. The scenario is illustrative and does not describe any specific organisation. Free to use with credit.