DCI: Dependency Confidence Index for Assessing Open-Source Dependency Trustworthiness
This paper introduces the Dependency Confidence Index (DCI), a composite metric that integrates nine empirically weighted trust factors derived from literature and developer surveys to assess open-source dependency trustworthiness, demonstrating its effectiveness through a pilot evaluation on 92 PyPI packages.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Every day, our digital lives rely on a vast, invisible network of software. From the apps on our phones to the systems managing our bank accounts, modern programs are rarely built from scratch. Instead, they are assembled like complex structures using pre-made parts, known as open-source dependencies, created by thousands of different people and organizations around the world. While this approach allows technology to advance rapidly, it introduces a significant risk: if one of these borrowed parts is flawed or malicious, the entire application built upon it can fail or be compromised. The challenge for developers is that there is no single, easy way to judge the trustworthiness of these countless components. They must sift through security reports, code quality checks, and project histories, often without a clear method to weigh which factors matter most.
To address this uncertainty, researchers at Chemnitz University of Technology have developed a new tool called the Dependency Confidence Index. This system acts as a unified scorecard, designed to help software developers decide whether to trust a specific piece of code before they use it. The researchers did not simply invent a new set of rules; they built their approach on a foundation of existing scientific understanding about what makes software reliable. They started by identifying nine key areas that contribute to trust, ranging from the security of the code itself to the health of the project maintaining it. These areas include how well the code is written, whether the project has a clear license, how frequently it is updated, and the reputation of the people behind it.
The core of the project involved translating these broad concepts into concrete, automated measurements. The team created a digital platform that can scan a software library and gather data on these nine factors. To determine how much weight each factor should carry in the final score, they consulted a small group of ten experienced software developers. These experts compared the factors against one another to decide which were most critical for safety and reliability. The result was a weighted system where security emerged as the most important factor, followed closely by the quality of the source code and the overall health of the project. The platform then takes the raw data it collects—such as the number of known vulnerabilities or the frequency of code updates—and combines them into a single number between zero and one. A score closer to one suggests a highly trustworthy component, while a lower score indicates potential risks.
The researchers tested their new index on ninety-two popular software packages used in the Python programming language. They found that the system worked consistently, producing the same results when run multiple times on the same packages. When they compared their new scores to an existing security tool called OpenSSF Scorecard, they observed a moderate agreement between the two. This suggests that the new index captures similar information to established tools but offers a different perspective. Interestingly, the analysis revealed that for these popular, high-quality packages, the scores were driven more by how well the project was managed—such as the use of automated testing and clear dependency rules—than by the presence of security flaws. In this specific group of tested packages, security metrics were so consistently high that they did not vary enough to distinguish between the different libraries. This does not mean security is unimportant; rather, it indicates that for mature, popular projects, the process of maintaining the software is often the strongest signal of trustworthiness.
The study also highlighted the limitations of their current approach. The researchers noted that their system relies on data that is sometimes difficult to gather automatically, such as the exact number of people who can maintain a project or the completeness of documentation. Furthermore, the test was limited to popular Python libraries, meaning the results might look different for older, less popular, or malicious packages where security flaws are more common. The team is careful to state that this index is not a replacement for specialized security tools or a guarantee that a piece of software is safe. Instead, it is intended to be a screening aid, helping developers organize the vast amount of information available about a library and identify which areas might need closer inspection. By providing a single, interpretable number alongside detailed breakdowns of each factor, the Dependency Confidence Index aims to make the complex task of software supply chain security more manageable for the people who build our digital world.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.