ossf/package-analysis

View on GitHub

Open Source Package Analysis

Stars: 912
Forks: 74
Open beginner issues: 0
Indexed issues: 66

Dominant language: Go
License: Apache-2.0
Last GitHub push: Jul 21, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue
PR merge metrics: No merged PRs in 30d

Beginner friendly Everything

Open All

66 open issues indexed

Proposal: Add support for R packages (CRAN) to Package Analysis Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/package-analysis#1192 · Opened Aug 25, 2026
OpenSSF Documentation Updates Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#1125 · Opened Dec 12, 2025
4gb Open

Difficulty 5/5 Over a week Newbie friendliness 5/100

ossf/package-analysis#1123 · Opened Sep 20, 2025
>4 gb Open

Difficulty 5/5 Over a week Newbie friendliness 10/100

ossf/package-analysis#1122 · Opened Sep 9, 2025
Bug Report: [Short summary of the bug] Open

Difficulty 5/5 Over a week Newbie friendliness 10/100

ossf/package-analysis#1121 · 2 comments · Opened Sep 9, 2025
OS level package analysis Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#1114 · Opened Apr 13, 2025
package-analysis error during django analysis Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ossf/package-analysis#1093 · 1 comment · Opened Jan 4, 2025
README instruction `make build_analysis_image` not valid anymore Open

Difficulty 1/5 Under an hour Newbie friendliness 55/100

ossf/package-analysis#1084 · Opened Dec 11, 2024
Support for Other Ecosystems like packagist and crates.io? Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#1083 · Opened Dec 3, 2024
enhancement: github-actions analysis Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#1055 · Opened Jun 12, 2024
Error from scanning the package Open

Difficulty 3/5 1-2 days Newbie friendliness 25/100

ossf/package-analysis#1047 · 3 comments · Opened May 3, 2024
Proposed legal & governance improvements for the OpenSSF Open

Difficulty 5/5 Over a week Newbie friendliness 15/100

ossf/package-analysis#1034 · 1 comment · Opened Mar 19, 2024
Create test packages that simulate malicious behaviors we want to catch Open

ossf/package-analysis#1001 · 1 assignee · Opened Jan 30, 2024
ES modules fail to be imported during node.js dynamic analysis Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

ossf/package-analysis#982 · Opened Dec 18, 2023
support extracting zip archives Open

static analysis

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/package-analysis#971 · 7 comments · 3 reactions · Opened Nov 16, 2023
restructure dynamic analysis schema Open

data enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

ossf/package-analysis#960 · Opened Nov 8, 2023
collect hash for downloaded archive Open

enhancement static analysis

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/package-analysis#959 · Opened Nov 8, 2023
Define a global entropy measurement for strings and literals Open

static analysis

Difficulty 5/5 Over a week Newbie friendliness 30/100

ossf/package-analysis#835 · 1 comment · Opened Aug 22, 2023
Add unit tests for GCP and PubSub buckets in ResultStore Open

go

Difficulty 3/5 1-2 days Newbie friendliness 48/100

ossf/package-analysis#828 · Opened Aug 15, 2023
Figure out how to interrupt long-running package functions during automated execution Open

dynamic analysis

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#775 · Opened Jun 20, 2023
Improve package download flow Open

enhancement needs discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#770 · Opened Jun 19, 2023
Log stdout and stderr from dynamic analysis process Open

dynamic analysis enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#764 · Opened Jun 14, 2023
Support Python packages that aren't on PyPI Open

dynamic analysis enhancement

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#755 · 2 comments · Opened Jun 8, 2023
DNS requests appear to be missing or incomplete. Open

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ossf/package-analysis#695 · 3 comments · Opened Mar 20, 2023
Allow running code as part of dynamic analysis Open

dynamic analysis needs discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#672 · 4 comments · Opened Mar 1, 2023
Make approach to defining enums consistent across the project Open

go internal cleanup needs discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#663 · 6 comments · Opened Feb 24, 2023
Consider adding process identifiers (PID, TID, process name) to dynamic analysis outputs Open

dynamic analysis enhancement

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ossf/package-analysis#648 · Opened Feb 16, 2023
Make a CI action to run each supported kind of analysis Open

enhancement infrastructure

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#637 · 1 comment · Opened Feb 13, 2023
Upload packages to each ecosystem that trigger detections Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#631 · Opened Feb 10, 2023
Improve code coverages using different technique in analyzers Open

dynamic analysis enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#588 · 2 comments · 1 reaction · Opened Jan 19, 2023
add baits to sandbox container Open

dynamic analysis enhancement

ossf/package-analysis#586 · 1 comment · 4 reactions · 1 assignee · Opened Jan 19, 2023
add urls (http+https) to json report Open

dynamic analysis enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#585 · 1 comment · 3 reactions · Opened Jan 19, 2023
Save raw pcap data Open

dynamic analysis

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#552 · 1 comment · 1 reaction · Opened Dec 21, 2022
Add more identifiers that are declared outside scope to parser output Open

enhancement static analysis

ossf/package-analysis#519 · 1 assignee · Opened Dec 12, 2022
Move the scheduler's PubSub messages from metadata to body Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#505 · 1 comment · 1 reaction · Opened Dec 8, 2022
SECURITY-INSIGHTS.yml implementation Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

ossf/package-analysis#460 · 4 comments · Opened Nov 23, 2022
Document the different ways to run the project Open

documentation

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/package-analysis#453 · Opened Nov 17, 2022
Parse package version from local archive when one is used Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/package-analysis#440 · Opened Nov 10, 2022
Add copyright header to project files Open

ossf/package-analysis#430 · 1 assignee · Opened Oct 31, 2022
Run analysis image as non-root user Open

enhancement low priority

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#394 · 1 comment · Opened Oct 12, 2022
docker-compose does not work with cgroupsv2 Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ossf/package-analysis#382 · 2 comments · 1 reaction · Opened Sep 30, 2022
PCAP Error Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#378 · 7 comments · Opened Sep 27, 2022
[worker] gracefully terminate when a SIGTERM is received Open

enhancement good first issue

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#376 · 2 comments · Opened Sep 27, 2022
Separate real-time and batch priority requests to analyze packages Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

ossf/package-analysis#373 · Opened Sep 23, 2022
[pypi] setup.py install based cmdclass not executed Open

bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ossf/package-analysis#369 · 1 comment · Opened Sep 21, 2022
Add a check to ensure sandbox images are accessable before executing them. Open

bug good first issue

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/package-analysis#346 · 1 comment · Opened Sep 7, 2022
Record DNS answers to queries that it sends Open

dynamic analysis enhancement

ossf/package-analysis#332 · 1 comment · 2 reactions · 1 assignee · Opened Aug 29, 2022
Race condition between when a new PyPI package is detected and when the package is installable Open

bug dynamic analysis needs discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#316 · 1 comment · Opened Aug 2, 2022
Consolidate sandbox images and inject analyze script at runtime Open

dynamic analysis enhancement needs discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/package-analysis#301 · 1 comment · Opened Jun 23, 2022
More robust mechanism for getting strace events from gVisor Open

dynamic analysis internal cleanup

Difficulty 4/5 3-5 days Newbie friendliness 30/100

ossf/package-analysis#277 · 7 comments · Opened May 9, 2022

ossf/package-analysis

Get new issues in your inbox