How to Use Trust Scores to Assess Package Risk

Intermediate 20 minutes Security Engineers / Compliance Teams Security & Policy

Understand the 0-100 composite trust score breakdown, filter by trust score, and build policies around package trust levels.

Overview

Chainsaw computes a composite Trust Score (0-100) for every package version that flows through the proxy. This score aggregates multiple supply chain signals into a single, actionable number. A score of -100 indicates confirmed malware.

Trust scores help you prioritize investigations, build risk-based policies, and communicate supply chain health to stakeholders.

Prerequisites

  • Packages flowing through Chainsaw (trust scores are computed automatically)
  • Access to the Intelligence page (Manager role or above)

Step 1: Understand the Trust Score Breakdown

The trust score is calculated from these components:

ComponentMax PointsHow It’s Earned
Malware Check-100 (kill)If package is in the known malware database, score is instantly -100
Vulnerability Status20No vulnerabilities: +20. CVSS < 4: +15. CVSS < 7: +10. CVSS < 9: +5. CVSS >= 9: +0
Provenance25Verified SLSA attestation: +25
License Compliance10Valid SPDX license present: +10
Package Age10Package older than 30 days: +10
Typosquat Check10Clean: +10. Suspected (high): -30. Suspected (medium): -20
Source Repository10Linked GitHub/GitLab repo: +10
Repo Liveness + Ownership10Upstream source repo is HTTP-reachable and the default branch has been pushed within the liveness window: +5. Publisher identity matches the repo owner (publisher-to-repo-owner match): +5. Prevents abandoned repos and mismatched-ownership drops from coasting to a passing score on trust alone.
Version Count10Multiple published versions: +10
Checksum Verified5Integrity hash matches: +5
Wave-4 reputation signals-40 (penalty band)Composite penalty drawn from maintainerAge, firstTimeCollaborator, nonexistentAuthor, suspiciousRepoStars, rttAnomaly, artifactRisk, publisherChanged, publishVelocityAnomaly, versionAnomaly, and hasHiddenUnicode. A clean ledger contributes 0; a single fired signal trims the score; multiple fired signals stack toward the cap.
Total100
Trust score breakdown visualization
Eleven scoring components combine into a single 0-100 number

Step 2: View Trust Scores in Intelligence

Navigate to Intelligence. The Trust Score column shows the composite score for each package.

The Bill of Materials does not carry this column, and neither does the BOM CSV export — sort those by malware_status and typosquat_status instead.

Intelligence page with trust score column
Trust scores are displayed alongside each package in Intelligence

Interpreting Scores

Score RangeRisk LevelTypical Action
80-100Low riskAllow freely
60-79Moderate riskMonitor, review periodically
40-59Elevated riskInvestigate, consider quarantine
1-39High riskBlock or require exception
-100Confirmed malwareAlways block

Step 3: Sort and Filter by Trust Score

In Intelligence, click the Trust Score column header to sort packages by risk level. This surfaces your most suspicious packages first.

Intelligence sorted by trust score ascending
Sort by trust score to see the riskiest packages first

Step 4: Create Trust Score Policies

Navigate to Policies and create policies based on trust score thresholds.

Block Low-Trust Packages

  1. Name: Block Low Trust Score
  2. Action: Block
  3. Condition: Trust Score → less than 30
  4. Scope: All repositories
Creating a trust score policy
Block packages with trust scores below your threshold

Quarantine Moderate-Risk Packages

  1. Name: Quarantine Moderate Risk
  2. Action: Quarantine
  3. Condition: Trust Score → less than 60
  4. Scope: Production service tokens only
Apply stricter trust score thresholds to production pipelines while keeping development environments more permissive. Use client type scoping to differentiate.

Step 5: Drill Into Score Components

When a package has a low trust score, investigate which components are dragging it down. Click the package in Intelligence to see the full breakdown.

Trust score component breakdown for a specific package
See exactly which signals contributed to a package's trust score

Common patterns:

Low Score CauseWhat to Do
Provenance missingCheck if ecosystem supports provenance. If not, adjust expectations
Typosquat suspectedVerify the package name is correct. Create an exception if legitimate
No licenseCheck upstream — some packages have licenses not in metadata
New package (< 30 days)Wait, or create a time-bound exception if needed urgently
VulnerabilitiesCheck CVEs and assess severity for your use case
maintainerAge firedMaintainer account is younger than the configured threshold (default 90 days). Treat as account-takeover-adjacent risk — dig into commit history before pinning
firstTimeCollaborator firedAuthor has never previously committed to this repo. Common in legitimate first-PR drops, but a known supply-chain attack staging pattern; cross-check with publisherChanged
nonexistentAuthor firedDeclared package author resolves to a deleted or unreachable account. Almost always reason to block until upstream is corrected
suspiciousRepoStars firedComposite of <5 stars, <30 days old, >90 days dormant — typical of a hastily-staged squatter. Investigate before allowing
publisherChanged firedMaintainer set diff vs. previous version — the canonical signature of an account takeover. Pair with an exception only if you can verify the change with the upstream project
publishVelocityAnomaly firedThe publishing account has spiked its 24-hour rolling publish count — worm-burst signal. Treat similar to publisherChanged
hasHiddenUnicode firedSource includes zero-width / bidi-override / tag characters. Almost never legitimate; quarantine while reviewing
rttAnomaly / artifactRisk firedRound-trip-time between commit and publish is anomalous, or per-artifact heuristics (file count, entropy, suspicious paths) tripped. Use as a tiebreaker, not a sole verdict

Use the Overview dashboard to monitor aggregate trust score health over time. Filter by repository or client to identify teams consuming riskier packages.

Trust score trends on the dashboard
Track how your organization's overall supply chain trust evolves

Step 7: Use Billy for Risk Analysis

Ask Billy to identify trust score patterns:

"What are the 10 lowest trust score packages we're using?"

"Show me packages with trust score below 50 installed by production service tokens"

"Which ecosystem has the lowest average trust score?"
Billy analyzing trust scores
Billy can help identify risk patterns across your package consumption

Next Steps