Consider deprecated packages as more risky (#284)

Signed-off-by: Prabhu Subramanian <prabhu@appthreat.com>

depscan/lib/analysis.py

@@ -1224,6 +1224,7 @@ def analyse_pkg_risks(
  if risk_metrics.get("risk_score") and (
  risk_metrics.get("risk_score") > config.pkg_max_risk_score
  or risk_metrics.get("pkg_private_on_public_registry_risk")
+ or risk_metrics.get("pkg_deprecated_risk")
  ):
  risk_score = f"""{round(risk_metrics.get("risk_score"), 2)}"""
  data = [

depscan/lib/pkg_query.py

@@ -319,6 +319,11 @@ def pypi_pkg_risk(pkg_metadata, is_private_pkg, scope):
  versions_dict = pkg_metadata.get("releases", {})
  versions = [ver[0] for k, ver in versions_dict.items() if ver]
  is_deprecated = info.get("yanked") and info.get("yanked_reason")
+ # Some packages like pypi:azure only mention deprecated in the description
+ # without yanking the package
+ pkg_description = info.get("description", "").lower()
+ if not is_deprecated and ("is deprecated" in pkg_description or "no longer maintained" in pkg_description):
+ is_deprecated = True
  latest_deprecated = False
  first_version = None
  latest_version = None

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "owasp-depscan"
-version = "5.2.15"
+version = "5.3.0"
 description = "Fully open-source security audit for project dependencies based on known vulnerabilities and advisories."
 authors = [
  {name = "Team AppThreat", email = "cloud@appthreat.com"},