Open Source Manager User Guide

This guide covers everything you need to know to effectively use Open Source Manager for open source security intelligence and package management.

Getting Started

Accessing OSM

1. Log in to Safeguard.sh
2. Navigate to Open Source Manager from the main menu
3. You'll see the OSM dashboard

Dashboard Overview

The OSM dashboard displays:

Searching Packages

Basic Search

1. Enter package name in search bar
2. Optionally specify version
3. Press Enter or click Search

Search Syntax

# Simple search
lodash

# With version
lodash@4.17.21

# With ecosystem
npm:lodash
pypi:requests
maven:org.apache.commons:commons-lang3

Supported Ecosystems

Search Results

Results show:

• Package name and version
• Attestation score (LCAL)
• Vulnerability count
• License
• Maintenance status
• Last updated

Package Details

Overview Tab

Vulnerabilities Tab

View all known vulnerabilities:

• CVE identifier
• Severity (CVSS score)
• EPSS score
• Fix available indicator
• Affected versions
• Remediation guidance

Attestation Tab

Supply chain verification:

• Provenance verification status
• Build attestation
• Signature verification
• SLSA level
• Malicious package scan results

Dependencies Tab

Package dependency tree:

• Direct dependencies
• Transitive dependencies
• Dependency vulnerabilities
• License analysis

Versions Tab

All available versions:

• Version number
• Release date
• Vulnerabilities per version
• Recommended version indicator

Gold Directory

What is Gold Directory?

Gold Directory contains pre-verified packages that meet Safeguard.sh's security standards:

• LCAL 3+ attestation
• No critical/high vulnerabilities
• Active maintenance
• License compliance verified

Using Gold Directory

1. Navigate to Gold Directory
2. Browse by category or search
3. Filter by ecosystem
4. Click package for details

Gold Package Benefits

Adding to Project

Use Gold packages in your projects:

# npm
npm install gold:lodash

# Or use the verified version directly
npm install lodash@4.17.21

Watchlist

Adding to Watchlist

Monitor packages for security updates:

1. Open package details
2. Click + Add to Watchlist
3. Configure notification preferences

Watchlist Management

1. Go to Watchlist tab
2. View all watched packages
3. Edit notification settings
4. Remove packages as needed

Notification Options

Risk Assessment

Understanding Risk Scores

Risk scores (0-100) consider:

Risk Categories

License Compliance

License Analysis

OSM analyzes licenses for:

• License type identification
• Compatibility checking
• Obligation requirements
• Commercial use restrictions

License Categories

Checking Compatibility

1. Open package details
2. Go to License tab
3. View license obligations
4. Check compatibility with your license

Comparing Packages

Side-by-Side Comparison

Compare alternative packages:

1. Search for a package
2. Click Compare
3. Add packages to compare
4. View comparison table

Comparison Metrics

• Security score
• Vulnerability count
• Maintenance health
• Download popularity
• Community size
• License type

API Usage

Search API

curl -X GET "https://api.safeguard.sh/v1/osm/packages?q=lodash" \
  -H "Authorization: Bearer $API_KEY"

Package Details

curl -X GET "https://api.safeguard.sh/v1/osm/packages/npm/lodash/4.17.21" \
  -H "Authorization: Bearer $API_KEY"

Vulnerabilities

curl -X GET "https://api.safeguard.sh/v1/osm/packages/npm/lodash/vulnerabilities" \
  -H "Authorization: Bearer $API_KEY"

Best Practices

Package Selection

• Check attestation score first
• Review vulnerability history
• Verify active maintenance
• Consider alternatives

Monitoring

• Watch critical dependencies
• Set up vulnerability alerts
• Review alerts promptly
• Update regularly

Compliance

• Define allowed licenses
• Check before adding dependencies
• Document exceptions
• Review periodically

Next Steps

• Gold Directory
• Attestation
• License Compliance