We keep hearing that dependency scanning is a solved problem — pick a tool, wire it into CI, done. That's true if you write JavaScript or Python. If you write Rust, Dart, or Elixir, the map has holes you can measure.
We counted the vulnerability advisories in each package ecosystem (from OSV.dev) against the number of open-source tools that can actually scan it (from the analysis-tools.dev catalog). The mismatch is not subtle.
TL;DR
- Across 11 ecosystems: 47,422 vulnerability advisories, and only 42 open-source security tools to cover all of them.
- Rust has 1,332 advisories per open-source scanner (2,663 advisories, 2 tools). Python's ratio is 999:1, PHP 979:1, Go 715:1.
- Dart (Pub) and Elixir (Hex) are "SCA deserts": real advisories exist (13 and 194), and zero catalogued open-source scanners cover them.
- Reproducible from two public datasets. The counting has one honest twist — see npm below.
Advisories per open-source scanner
The signal (known vulnerabilities) and the capacity to scan for it (tools) are, in the study's words, "only weakly aligned." Here's the ratio for the busiest ecosystems:
| Ecosystem | Vuln advisories | OSS tools | Advisories per tool |
|---|---|---|---|
| Rust (crates.io) | 2,663 | 2 | 1,332 : 1 |
| Python (PyPI) | 12,992 | 13 | 999 : 1 |
| PHP (Packagist) | 6,851 | 7 | 979 : 1 |
| Go | 8,577 | 12 | 715 : 1 |
| JavaScript (npm) | 6,998 | 10 | 700 : 1 |
| Java (Maven) | 6,859 | 10 | 686 : 1 |
A high ratio doesn't mean the tools are bad — the good ones scale fine. It means the diversity of coverage is thin: if the two Rust scanners miss an ecosystem-specific advisory format or a new source, there's no third option to catch it.
The deserts: signal with no open-source scanner
Two ecosystems have vulnerability advisories and, per the catalog, no open-source security scanner at all:
- Dart (Pub): 13 advisories, 0 tools.
- Elixir (Hex): 194 advisories, 0 tools.
194 known-vulnerable-package advisories with zero open-source coverage is not a rounding error for a team shipping Phoenix apps. This is exactly the kind of gap that stays invisible until someone asks "why didn't our scanner catch that?"
The npm twist (why raw counts lie)
npm looks terrifying if you take OSV at face value: 223,802 advisories. But 96.9% of those are malicious-package advisories (the MAL- prefix — typosquats, protestware, install-script miners), not vulnerabilities in legitimate packages. Lump them together and npm looks like the riskiest ecosystem on earth; split them out and the real vulnerability count is 6,998.
That split matters for honesty. A vendor motivated to make a number look big would quote the 223,802. We separated malicious-package advisories from vulnerability advisories precisely so the per-ecosystem comparison isn't distorted — and so we're not the vendor quoting the scary number.
How it was measured
Two public datasets, no survey:
-
OSV.dev per-ecosystem archives — the JSON advisory feeds, counted per ecosystem, with
MAL-advisories separated out. -
analysis-tools.dev catalog — open-source tools tagged
security, counted per language.
# advisories: OSV.dev per-ecosystem archives (split MAL- from vuln)
# tools: analysis-tools.dev catalog, security-tagged, per language
# full parser + the 47,422-advisory / 42-tool derivation:
zennoxa.com/research/sca-coverage-gap-2026
The complete table — all 11 ecosystems, the malicious-vs-vuln split, and the commands to reproduce it — is here:
→ The SCA coverage gap: where vulnerability signal outruns open-source tooling
Published by Zennoxa Research. If your ecosystem has an open-source scanner the catalog missed, that changes the ratio — tell us and we'll correct it.
Top comments (0)