• English

    • Using the catalog

    The catalog combines information about packages available to the user in CodeScoring and shows where they are used in SCA projects, OSA packages, and container images. The available data depends on the enabled modules and the user's permissions.

    Viewing the package catalog

    To open the catalog, go to Catalog -> Packages. The table contains the following information:

    • Package — package name and version with a link to its details page;
    • Technology — programming language or build technology;
    • Licenses — package licenses;
    • Vulnerabilities — number of vulnerabilities found;
    • SCA projects — number of current package occurrences in available SCA projects;
    • OSA packages — number of related OSA packages;
    • Container images — number of container images in which the package was found.

    You can search for packages by name, version, or PURL and filter them by technology, license, and the presence of vulnerabilities. The In SCA project, In OSA package, and In OSA container image filters show packages that are or are not used in the corresponding components.

    Package catalog

    Click the package name to open its details page. You can also open the catalog details page from the PURL link on an SCA dependency or OSA package page.

    Viewing package information

    The top of the details page contains general package information:

    • PURL — unique package identifier that can be copied;
    • Technology, Licenses, and Version;
    • Authors, Homepage, VCS, and Index URL, when available;
    • Released at — publication date of the package version;
    • Status — revoked status when the package is deprecated or yanked in the package index.

    Additional security attributes are displayed below: risks (malware/protestware software), source distribution, attack surface, security function, provider, and internal source status.

    Package details page in the catalog

    The details page contains the following sections:

    • Vulnerabilities — vulnerabilities found, including CVSS scores, SSVC, EPSS, and CWE data, as well as the fixed version. Impact data is also displayed when the Kaspersky feed is enabled;
    • OSA packages — related OSA packages with their actuality, technology, block status, publication and latest request dates, repository, and repository manager;
    • Projects — current package occurrences in SCA projects, including relation type, match type, environment, requirement, files, parent dependencies, and licenses;
    • Container images — images in which the package was found, including the registry, number of dependencies and vulnerabilities, block status, and latest scan date.

    Search and filtering are available for the project, OSA package, and container image lists. The related-data tables also support sorting and pagination. Project, OSA package, and container image names link to their details pages. The OSA packages and Container images sections are displayed only when the user has the corresponding permissions.

    Was this page helpful?