Research reveals where 95% of open source vulnerabilities lie
New research from Endor Labs offers a view into the rampant but often unmonitored use of existing open-source software in application development and the dangers arising from this common practice.
As just one example, the research reveals that 95% of all vulnerabilities are found in transitive dependencies – open-source code packages that developers do not select, but are indirectly pulled into projects.
This is the first report from Station 9, a research capability developed by Endor Labs that brings together researchers, academics and thought leaders from around the world. `“In this environment, open source software is the backbone of our critical infrastructure – but even veteran developers and executives are often surprised to learn 80% of the code in modern applications comes from existing OSS,” said Varun Badhwar, CEO of Endor Labs.
