May 6, 2024 Lineaje Unveils First-of-its-Kind Open-Source Manager

The latest addition to the Lineaje product portfolio empowers organizations to secure the entire software supply chain.

According to research, 95% of all application risk is found in open-source software, which carries ten times higher risk than code written by internal developers. With Lineaje’s OSM, you can find every package, all the way down to the last level, and explore the hidden depths of open-source dependencies by tracking over 20 levels. Unlike any other tool, it offers risk analysis for every link in the supply chain, including the most vulnerabilities. OSM is exceptional in that it can identify software components with questionable provenance and identify tampers such as 3CX, XZ, and SolarWinds. It accomplishes this by automatically attesting each component for tamperability and integrity.

“As organizations continue to embrace open-source to drive high innovation and to accelerate development cycles, our software supply chain is effectively open-sourced. Open-source developers are typically great innovators but not-so-great maintainers of software,” said Javed Hasan, CEO &

Co-Founder, Lineaje. “OSM is an automated open-source office in a box, extending an organization’s AppSec posture to open-source dependencies. It not only separates well-maintained and unmaintained open-source components but enables proactive mitigation of embedded open-source risks.”

OSM goes beyond discovery by introducing an innovative “plan & fix” module. Not all patches or vulnerability fixes are equally compatible or applied at the same dependency depth. Lineaje AI with BOMbots generates plans in minutes for open-source patching so that developers can apply all compatible and all incompatible patches in batches. This reduces mean time to protect (MTTP) and saves up to 40% in software maintenance efforts. Unmaintained components with unfixed vulnerabilities and policy violations can be routed to inner or out-sourced teams chartered to maintain risky open-source dependencies.

“As developers increasingly leverage open-source code to save time and increase their productivity and innovation, organizations need robust security measures because attackers often target vulnerabilities in commonly used open-source packages,” said Melinda Marks, Practice Director, Cybersecurity, Enterprise Strategy Group. “Lineaje’s Open-Source Manager will help organizations safely leverage open-source by identifying potential risks and remediating vulnerabilities, while also facilitating compliance with governance regulations.”

Enable Full Lifecycle Management of Open-Source with Trust

The OSM solution enables companies to:

• Simplify Discovery & Search Comprehensively: Find and search all direct open-source dependencies down to the deepest level and discover the impact of vulnerabilities and risks.
• Analyze Inherent Risk: Automatically examine each component and application for risks–vulnerabilities, licenses, code quality, security posture, maintainability, age, supplier, provenance and more.
• Monitor Tamperability & Integrity Levels: Sophisticated fingerprinting identifies components that have suspicious and unknown origins.
• Establish Governance: Use consistent criteria for selecting, upgrading and fixing open-source components, and create rules for each. Auto-detect components violating policy using Lineaje’s Findings engine.
• Optimize Planning and Fix: Lineaje AI, using BOMbots, builds SMART “what if” plans in minutes. These SMART plans reduce maintenance efforts by up to 40%.
• Fix Unmaintained Open-Source: 95% of all vulnerabilities come from open-source; 56% of them are left unresolved. Unmaintained open-source components identified by OSM are routed to the inner or outer sourced development teams with detailed remediation instructions.
• Integrated Search: Search all dependencies in seconds for vulnerabilities, licenses, provenance, supplier details and more across all supply chain trees, enhancing operational efficiency.

“With the proliferation of open-source components in all applications, directly managing open-source dependencies has become paramount. Lineaje’s Open-Source Manager enables not only discovery but also planning and remediation of vulnerabilities,” said Ashok Banerjee, SVP, Product Engineering, Trellix. “Supply Chain Security is an essential tool for the modern software factory.”

Subscribe to Industry Today