Nine-tenths of the average codebase arrived via package manager, and attackers noticed years ago. With modern breaches increasingly originating from upstream software supply chain attacks targeting open-source registries, scanning third-party dependencies is no longer optional. We scored ten SCA...