一句话：提出跨生态平台 Package Dashboard，融合包元数据、漏洞与社区健康指标，推荐替代包以加速供应链风险修复。
现有软件成分分析（SCA）因包管理生态与开源社区彼此隔离，导致开发者需手动整合分散数据，风险评估可靠性受限。本文提出 Package Dashboard，一个跨生态系统平台，综合软件包元数据、漏洞情报与上游社区健康指标，进行整体供应链分析，并给出可操作建议，如为高风险包推荐韧性替代方案。作者对 374,000 个软件包进行广泛分析，并在三个真实风险缓解场景中开展用户研究。结果表明，该方法能发现潜在风险，并将修复时间最多缩短 70%，从而打通从识别风险到选择替代包的闭环。平台已公开并提供开源代码与演示视频。
Recent software supply chain attacks have revealed a critical sociotechnical gap in current Software Composition Analysis (SCA) implementations - isolation among package management ecosystems and open source communities. This fragmentation poses manual overhead, forcing developers to synthesize scattered data, and potentially undermines the reliability of risk assessments. To address this, we present Package Dashboard, a cross-ecosystem platform that: 1) synthesizes package metadata, vulnerability feeds, and upstream community health metrics for holistic software supply chain analysis; 2) provides actionable insights, e.g., recommending resilient alternatives to mitigate risky packages. Through an extensive analysis of 374,000 packages and a user study in three real-world risk mitigation scenarios, we demonstrate that our approach not only uncovers latent risks but also reduces remediation time by up to 70%, effectively closing the loop between identifying risks and selecting replacements. Package Dashboard is publicly available at https://pkgdash.osslabpku.org, the code is open source at https://github.com/osslabpku/PackageDashboard, and a demonstration video can be found at https://youtu.be/y9ncftP8KPQ.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{LiuHZ26,
title = {Package Dashboard: A Cross-Ecosystem Framework for Dual-Perspective Analysis of Software Packages},
author = {Ziheng Liu and Runzhi He and Minghui Zhou},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3806413}
}