Software composition analysis (SCA)

An SCA tool works in three stages. Discovery builds the dependency inventory by parsing manifests and, preferably, lockfiles (package-lock.json, poetry.lock, go.sum, Cargo.lock, pom.xml resolved through Maven), resolving the full transitive graph, and - for compiled artefacts or container images - fingerprinting binaries, JARs and OS packages. Identification maps each component to a canonical identifier, today usually a Package URL (purl) and sometimes a CPE. Matching compares name and version against vulnerability sources such as the NVD (CPE-based), OSV.dev (ecosystem-native version ranges aggregated from GitHub Security Advisories, PyPA, RustSec, Go and others) and vendor feeds, and against licence data expressed as SPDX licence identifiers. The output is often an SBOM plus findings, which is why SCA and SBOM tooling increasingly overlap.

Accuracy is limited by identification. CPE matching generates false positives (a CVE for a product with a similar name) and misses (a component whose CPE was never assigned), and the NVD's enrichment backlog since early 2024 left many CVEs without CPE data for months, pushing tools towards OSV-style ecosystem advisories. Lockfile-less projects give only version ranges, so the scanner must guess what will be installed; vendored, shaded or statically linked code escapes manifest-based scanning entirely.

Prioritisation separates useful programmes from noisy ones. A vulnerable function is often not reachable from the application's call graph, so modern tools add reachability analysis; exploit likelihood (EPSS), presence in CISA's Known Exploited Vulnerabilities catalogue and supplier VEX statements further narrow the list. Remediation is automated with Dependabot or Renovate pull requests that bump versions, but transitive fixes may require overrides or waiting for an intermediate maintainer. Licence analysis flags strong copyleft terms (GPL, AGPL) in distributed or network-exposed software and missing attribution obligations.

SCA has also expanded from known-vulnerability matching to supply-chain threats: detecting typosquatted or newly published malicious packages, dependency confusion (demonstrated publicly by Alex Birsan in 2021, when internal package names were claimed on public registries), install scripts that execute on npm install, and abandoned maintainership. OWASP ranked "Vulnerable and Outdated Components" as A06 in the Top 10:2021, and the 2025 edition broadened it to "Software Supply Chain Failures" at A03:2025. SCA differs from SAST, which analyses first-party source for coding flaws, and from container image scanning, which applies the same matching to OS packages in an image; it is a kind of vulnerability scanning focused on third-party components rather than running hosts.