# What Is the SC4 Analyzer in SkillSpector? Detecting Known Vulnerable Dependencies

> Discover how the SkillSpector SC4 analyzer detects vulnerable dependencies by querying OSV.dev for real-time security insights. Keep your code secure.

- Repository: [NVIDIA Corporation/SkillSpector](https://github.com/NVIDIA/SkillSpector)
- Tags: deep-dive
- Published: 2026-06-21

---

**The SC4 analyzer in SkillSpector identifies package dependencies with known security vulnerabilities by querying the OSV.dev database in real-time and falling back to static vulnerability lists when offline.**

NVIDIA's SkillSpector includes SC4 as one of its six supply-chain security rules designed to flag vulnerable dependencies in manifest files like [`requirements.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements.txt) and [`package.json`](https://github.com/NVIDIA/SkillSpector/blob/main/package.json). This analyzer integrates live vulnerability lookups with offline-capable fallback data to ensure continuous security coverage regardless of network availability.

## How SC4 Detects Vulnerable Dependencies

The SC4 analyzer operates through a two-stage detection pipeline implemented in [`src/skillspector/nodes/analyzers/static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_supply_chain.py).

### Live OSV.dev Query

First, SC4 attempts a **live lookup** to the public OSV.dev vulnerability database. The `_sc4_from_osv` function (lines 887-904) sends batch requests containing extracted package names and versions from dependency manifests. When OSV returns advisories, the analyzer determines the worst severity among the results and generates an `AnalyzerFinding` containing the CVE identifier, description, and confidence score derived from the advisory severity (lines 887-934).

### Static Fallback Mechanism

If OSV cannot be reached or the package lacks an entry, SC4 falls back to hard-coded vulnerability tables. The `_sc4_from_fallback` function (lines 936-976) checks packages against `_FALLBACK_VULNERABLE_PYPI` and `_FALLBACK_VULNERABLE_NPM` structures. When a match occurs, the analyzer emits a high-severity finding with advisory text and suggested safe versions, ensuring offline operation.

## SC4 Integration in the Supply-Chain Analysis Pipeline

### Dependency Extraction

Before vulnerability detection, the analyzer extracts package data from manifest files. For Python projects, `_extract_packages_from_requirements` parses [`requirements.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements.txt) (lines 88-100), while `_extract_packages_from_package_json` handles npm manifests. These functions extract package names and version pins to feed into the SC4 detection logic.

### Node Orchestration

The top-level `node()` function (lines 860-889) orchestrates the analysis flow. It first runs generic static patterns (SC1-SC3), then invokes `_analyze_dependencies` to execute SC4 alongside SC5 (abandoned packages) and SC6 (typosquatting). All findings populate the `SkillspectorState` for downstream processing and user reporting.

## Practical Example: Running SC4 Analysis

Below is a minimal example demonstrating how to invoke the SC4 analyzer manually against a Python project:

```python
from skillspector.state import SkillspectorState
from skillspector.nodes.analyzers.static_patterns_supply_chain import node as supply_chain_node

# Define a synthetic repository state with vulnerable dependencies

state = SkillspectorState(
    components=["requirements.txt"],
    file_cache={"requirements.txt": "pyyaml==5.3\nrequests\n"},
    manifest={},
)

# Execute the supply-chain analyzer (SC1-SC6)

response = supply_chain_node(state)

# Filter for SC4 findings only

sc4_findings = [f for f in response["findings"] if f.rule_id == "SC4"]
for finding in sc4_findings:
    print(f"⚠️  {finding.message} (severity={finding.severity.name})")

```

When network access to `api.osv.dev` is available, this outputs live vulnerability data:

```text
⚠️  Known Vulnerable Dependency: pyyaml==5.3 — 1 advisory(ies): CVE-2020-14343 (arbitrary code execution via yaml.load) (severity=HIGH)

```

Without network connectivity, the fallback tables generate similar high-severity warnings for known vulnerable packages like `pyyaml`.

## Key Source Files for SC4 Implementation

Understanding the SC4 analyzer requires familiarity with these components:

- **[`src/skillspector/nodes/analyzers/static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/static_patterns_supply_chain.py)** — Implements the complete SC4 logic including OSV queries (`_sc4_from_osv`), fallback handling (`_sc4_from_fallback`), and dependency extraction functions.

- **[`src/skillspector/nodes/analyzers/osv_client.py`](https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/nodes/analyzers/osv_client.py)** — Contains the thin REST API wrapper that SC4 uses to communicate with OSV.dev.

- **[`docs/SC4-osv-live-vulnerability-lookups.md`](https://github.com/NVIDIA/SkillSpector/blob/main/docs/SC4-osv-live-vulnerability-lookups.md)** — Project documentation detailing SC4's data flow, severity mapping, and usage guidelines.

- **[`tests/unit/test_patterns_new.py`](https://github.com/NVIDIA/SkillSpector/blob/main/tests/unit/test_patterns_new.py)** — Unit tests verifying SC4 behavior with mocked OSV responses and fallback validation.

## Summary

- **SC4** is the "Known Vulnerable Dependencies" rule in SkillSpector's supply-chain analyzer suite.
- It performs **two-stage detection**: live OSV.dev queries followed by static fallback tables for offline operation.
- The analyzer processes **PyPI and npm** manifests, extracting package data via dedicated parser functions.
- Vulnerability findings include **CVE identifiers**, severity classifications, and remediation hints.
- Implementation resides primarily in [`static_patterns_supply_chain.py`](https://github.com/NVIDIA/SkillSpector/blob/main/static_patterns_supply_chain.py) with OSV integration via [`osv_client.py`](https://github.com/NVIDIA/SkillSpector/blob/main/osv_client.py).

## Frequently Asked Questions

### What does SC4 stand for in SkillSpector?

SC4 represents the fourth supply-chain security rule in SkillSpector's analyzer sequence, specifically designated as the "Known Vulnerable Dependencies" check. It operates alongside SC1 through SC3 (generic pattern matching) and SC5 through SC6 (abandoned packages and typosquatting detection).

### How does SC4 handle network connectivity issues?

When the OSV.dev API is unreachable, SC4 automatically falls back to hard-coded vulnerability tables (`_FALLBACK_VULNERABLE_PYPI` and `_FALLBACK_VULNERABLE_NPM`). These static lists ensure the analyzer continues detecting common vulnerable packages even in offline environments, though with potentially less comprehensive coverage than the live database.

### What package ecosystems does the SC4 analyzer support?

SC4 currently supports **Python (PyPI)** and **Node.js (npm)** ecosystems. The analyzer includes specialized extraction functions for [`requirements.txt`](https://github.com/NVIDIA/SkillSpector/blob/main/requirements.txt) files in Python projects and [`package.json`](https://github.com/NVIDIA/SkillSpector/blob/main/package.json) files in Node.js projects, with extensible architecture for additional package managers.

### How does SC4 determine the severity of vulnerabilities?

For live OSV queries, SC4 maps the worst severity rating from returned advisories to SkillSpector's internal `Severity` enum. For fallback detections, the analyzer automatically assigns high-severity ratings to known vulnerable packages based on the static table definitions, ensuring conservative security postures when precise CVSS scores are unavailable.