What Is the SC4 Analyzer in SkillSpector? Detecting Known Vulnerable Dependencies

The SC4 analyzer in SkillSpector identifies package dependencies with known security vulnerabilities by querying the OSV.dev database in real-time and falling back to static vulnerability lists when offline.

NVIDIA's SkillSpector includes SC4 as one of its six supply-chain security rules designed to flag vulnerable dependencies in manifest files like requirements.txt and package.json. This analyzer integrates live vulnerability lookups with offline-capable fallback data to ensure continuous security coverage regardless of network availability.

How SC4 Detects Vulnerable Dependencies

The SC4 analyzer operates through a two-stage detection pipeline implemented in src/skillspector/nodes/analyzers/static_patterns_supply_chain.py.

Live OSV.dev Query

First, SC4 attempts a live lookup to the public OSV.dev vulnerability database. The _sc4_from_osv function (lines 887-904) sends batch requests containing extracted package names and versions from dependency manifests. When OSV returns advisories, the analyzer determines the worst severity among the results and generates an AnalyzerFinding containing the CVE identifier, description, and confidence score derived from the advisory severity (lines 887-934).

Static Fallback Mechanism

If OSV cannot be reached or the package lacks an entry, SC4 falls back to hard-coded vulnerability tables. The _sc4_from_fallback function (lines 936-976) checks packages against _FALLBACK_VULNERABLE_PYPI and _FALLBACK_VULNERABLE_NPM structures. When a match occurs, the analyzer emits a high-severity finding with advisory text and suggested safe versions, ensuring offline operation.

SC4 Integration in the Supply-Chain Analysis Pipeline

Dependency Extraction

Before vulnerability detection, the analyzer extracts package data from manifest files. For Python projects, _extract_packages_from_requirements parses requirements.txt (lines 88-100), while _extract_packages_from_package_json handles npm manifests. These functions extract package names and version pins to feed into the SC4 detection logic.

Node Orchestration

The top-level node() function (lines 860-889) orchestrates the analysis flow. It first runs generic static patterns (SC1-SC3), then invokes _analyze_dependencies to execute SC4 alongside SC5 (abandoned packages) and SC6 (typosquatting). All findings populate the SkillspectorState for downstream processing and user reporting.

Practical Example: Running SC4 Analysis

Below is a minimal example demonstrating how to invoke the SC4 analyzer manually against a Python project:

from skillspector.state import SkillspectorState
from skillspector.nodes.analyzers.static_patterns_supply_chain import node as supply_chain_node

# Define a synthetic repository state with vulnerable dependencies

state = SkillspectorState(
    components=["requirements.txt"],
    file_cache={"requirements.txt": "pyyaml==5.3\nrequests\n"},
    manifest={},
)

# Execute the supply-chain analyzer (SC1-SC6)

response = supply_chain_node(state)

# Filter for SC4 findings only

sc4_findings = [f for f in response["findings"] if f.rule_id == "SC4"]
for finding in sc4_findings:
    print(f"⚠️  {finding.message} (severity={finding.severity.name})")

When network access to api.osv.dev is available, this outputs live vulnerability data:

⚠️  Known Vulnerable Dependency: pyyaml==5.3 — 1 advisory(ies): CVE-2020-14343 (arbitrary code execution via yaml.load) (severity=HIGH)

Without network connectivity, the fallback tables generate similar high-severity warnings for known vulnerable packages like pyyaml.

Key Source Files for SC4 Implementation

Understanding the SC4 analyzer requires familiarity with these components:

• src/skillspector/nodes/analyzers/static_patterns_supply_chain.py — Implements the complete SC4 logic including OSV queries (_sc4_from_osv), fallback handling (_sc4_from_fallback), and dependency extraction functions.

• src/skillspector/nodes/analyzers/osv_client.py — Contains the thin REST API wrapper that SC4 uses to communicate with OSV.dev.

• docs/SC4-osv-live-vulnerability-lookups.md — Project documentation detailing SC4's data flow, severity mapping, and usage guidelines.

• tests/unit/test_patterns_new.py — Unit tests verifying SC4 behavior with mocked OSV responses and fallback validation.

Summary

• SC4 is the "Known Vulnerable Dependencies" rule in SkillSpector's supply-chain analyzer suite.
• It performs two-stage detection: live OSV.dev queries followed by static fallback tables for offline operation.
• The analyzer processes PyPI and npm manifests, extracting package data via dedicated parser functions.
• Vulnerability findings include CVE identifiers, severity classifications, and remediation hints.
• Implementation resides primarily in static_patterns_supply_chain.py with OSV integration via osv_client.py.

Frequently Asked Questions

What does SC4 stand for in SkillSpector?

SC4 represents the fourth supply-chain security rule in SkillSpector's analyzer sequence, specifically designated as the "Known Vulnerable Dependencies" check. It operates alongside SC1 through SC3 (generic pattern matching) and SC5 through SC6 (abandoned packages and typosquatting detection).

How does SC4 handle network connectivity issues?

When the OSV.dev API is unreachable, SC4 automatically falls back to hard-coded vulnerability tables (_FALLBACK_VULNERABLE_PYPI and _FALLBACK_VULNERABLE_NPM). These static lists ensure the analyzer continues detecting common vulnerable packages even in offline environments, though with potentially less comprehensive coverage than the live database.

What package ecosystems does the SC4 analyzer support?

SC4 currently supports Python (PyPI) and Node.js (npm) ecosystems. The analyzer includes specialized extraction functions for requirements.txt files in Python projects and package.json files in Node.js projects, with extensible architecture for additional package managers.

How does SC4 determine the severity of vulnerabilities?

For live OSV queries, SC4 maps the worst severity rating from returned advisories to SkillSpector's internal Severity enum. For fallback detections, the analyzer automatically assigns high-severity ratings to known vulnerable packages based on the static table definitions, ensuring conservative security postures when precise CVSS scores are unavailable.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}