Typical severity: High. Likelihood of attack: Medium. An adversary spoofs open-source software metadata in an attempt to masquerade malicious software as popular, maintained, and trusted.
Before downloading open-source software, perform precursory metadata checks to determine the author(s), frequency of updates, when the software was last updated, and if the software is widely leveraged. | Within package managers, look for conflicting or non-unique repository references to determine if multiple packages share the same repository reference. | Reference vulnerability databases to determine if the software contains known vulnerabilities. | Only download open-source software from reputable hosting sites or package managers. | Only download open-source software that has been adequately signed by the developer(s). For repository commits/tags, look for the "Verified" status and for developers leveraging "Vigilant Mode" (GitHub) or similar modes.