Self-hosted apps that publish packages to registries have far fewer advisories invisible to scanners

A follow-up study found that about half of self-hosted applications' own security advisories name no package in OSV, leaving them invisible to tools like Dependabot, npm audit and pip-audit. The researchers tested whether publishing an official package to a registry that OSV indexes predicts visibility, using a pre-registered rule and a fresh set of apps. Apps without a registry package had a median of 100% of their advisories blind, while registry-publishing apps had a median of about 27%, a difference that held on the new sample. The authors caution that this is an association, since registry publishing overlaps with ecosystem, age and security-process maturity, and that publishing alone is not enough unless advisories name the published package. Maintainers are advised to publish to their ecosystem's registry and name the package in GHSA advisories to make them reachable by scanners.