A sample product assessment

1. The inventory

A scanner’s output for a shared worker container: 10 components. The document scores 67 out of 100 for completeness: it names versions and identifiers, but 0% of components name a supplier and 0% a licence.

• axios 0.32.0
• cryptography 46.0.5
• debug 2.6.9
• eslint-plugin-restart-vega-soap 1.0.0
• nginx 1.18.0-6.1+deb11u8
• node 20.15.1
• openssl 3.0.19-1~deb12u2
• org.apache.logging.log4j:log4j-core 2.25.4
• py-infopullhydra 1.0.0
• snakeyaml 2.0

2. The findings

26 open findings on those components: 3 critical, 13 high, 7 medium and 3 low. The malicious packages come first, because the record says they were published to do harm.

3. The release-policy result Blocked

This SBOM does not pass the release policy: 2 malicious packages against a limit of 0. The product’s grade is D, a score of 40.0.

4. The selected fixes

In order. No upgrade clears a malicious package, so removing them comes first and is what lifts this blocker.

1. Remove eslint-plugin-restart-vega-soap@1.0.0
2. Remove py-infopullhydra@1.0.0
3. Upgrade openssl 3.0.19-1~deb12u2 → 3.0.20-1~deb12u2 clears 9
4. Upgrade axios 0.32.0 → 0.34.0 clears 9
5. Upgrade cryptography 46.0.5 → 50.0.0 clears 5

The three upgrades alone would clear 23 findings. The grade stays D, at a score of 40.0, because an active malicious package holds a product at D or worse until it is removed. Once the changes ship, the next SBOM goes through the same check.

5. The evidence

Against the EU Cyber Resilience Act, this product reads 34.4% ready across 16 applicable controls: 4 satisfied, 3 needing attention, 4 gaps and 5 awaiting attestation. Readiness is a figure for review, never a certification.

Files you can open

• The readiness report PDF, as a reader prints it
• The inventory CycloneDX
• The findings SARIF
• The VEX document CSAF; this product has no statements yet