Published research · March 23, 2026

Beyond CVEs

A practical approach to interpreting structural OSS risk in the AI era.

AI changes how some repository signals look, but structure still determines what they mean.

The study presents Biguá Analyzer as an open-source framework for examining structural OSS indicators such as contribution concentration, contributor redundancy, turnover, activity dynamics, historical participation, and inferred AI influence.

Explore the findings Download the paper

Research Question

Has the transition from pre-AI to AI-assisted development changed the structural signals that define OSS project health and risk?

42 repositories analyzed

5 language ecosystems

2 analysis modes

4 high-deviation structural outliers

≈0.453 median inferred AI influence

Four Main Findings

Structural metrics remain the strongest observed explanatory layer for OSS resilience and fragility.

Contribution concentration, contributor redundancy, and long-tail historical participation remain more explanatory than AI-adjacent signals alone.

AI-related patterns are widespread, but they are better understood as an ambient capability layer than a primary structural driver.

Recent-window analysis is useful for screening, but high-impact or high-deviation dependencies need full-history structural review.

Explore the Research

Methodology and metrics Repository selection, GitHub data sources, structural metrics, AI influence, and confidence. Findings A visual summary of the main results and what the traffic light does and does not mean. Fast mode versus full history Why recent-window screening and full-history analysis can produce different readings. AppSec implications A practical decision model for dependency review and supply-chain assessment. Research materials Paper, repository, releases, datasets, citation metadata, metrics docs, and contact links.