How ranking works
Teardown puts every finding in a group using published rules, then orders findings within a group by score. The same dependencies and the same vulnerability data always give the same result. Each analysis records the method version and the date of every data source it used.
The groups
| Group | What puts a finding there |
|---|---|
| Fix first | Malware reported against the package. A compromised version. Known to be exploited (in CISA KEV), in any dependency. Likely to be exploited, in a package your app ships, when it can be attacked over the network without privileges or user interaction, or has total impact, such as code execution. |
| Fix next | Likely to be exploited, but only in a development dependency. Likely to be exploited, but harder to attack. Critical or high severity with no sign of exploitation. |
| Low risk | Everything else. |
| Clean | No known vulnerabilities. |
In a group, likely to be exploited means a public exploit or an EPSS score of 10% or higher. A package sits in the group of its highest finding. Exploitation evidence decides Fix first whatever the severity. Severity only matters when there’s no sign of exploitation. Groups measure exploitation risk, not package health.
Malware
Malicious packages lead Fix first and aren’t scored. With no safe version, the fix is to remove the package. When a malware report names a fixed version, the affected releases count as compromised and the fix is an upgrade.
Evidence
- Malware reported
- A GitHub or OSV malware record names this version.
- Known to be exploited
- Listed in CISA KEV.
- A public exploit exists
- A Metasploit module or nuclei template targets it.
- Likely to be exploited
- An EPSS score of 10% or higher.
- No known exploit
- An EPSS score under 10%.
- No known exploit, no EPSS score
- No CVE, or FIRST hasn’t scored it. Missing data never counts as zero.
Order within a group
A score from 0 to 100 sets the order, weighing exploitation 40%, severity 30%, exposure 15% and blast radius 15%. Without an EPSS score or a KEV listing, severity stands in for exploitation, capped at the 10% line. The score orders findings within a group. It never changes a finding’s group.
Terms
- KEV
- CISA’s Known Exploited Vulnerabilities catalog, of vulnerabilities with evidence of real attacks.
- EPSS
- FIRST’s daily estimate of the probability that a CVE is exploited in the next 30 days.
- Public exploit
- A Metasploit module or nuclei template for the vulnerability, so a ready-made attack or check is public.
- Automatable
- The CVSS vector says it can be attacked over the network with no privileges and no user interaction.
- Total impact
- The CVSS vector shows a full loss of confidentiality, integrity and availability, or the vulnerability’s title or description names code or command execution.
- Ships with your app
- At least one of the app’s runtime dependencies leads to the package, so it’s part of what runs.
Data sources
CISA KEV, Metasploit (BSD-3-Clause) and nuclei-templates (MIT) are mirrored every six hours. A mirror more than three days stale isn’t used, and the finding says which source is missing.
In the week to 1 Nov 2026, every vulnerability GitHub reviewed reached Teardown within 10 minutes of publication, and half within 5. Ones that appear only in OSV arrive later.
Unconfirmed vulnerabilities
Vulnerabilities GitHub hasn’t reviewed show on their package as unconfirmed. They aren’t ranked, counted or put in a prompt.
SSVC
Fix first, Fix next and Low risk map roughly to SSVC’s Act, Attend and Track.
Versions
Score v2.1 (20 Oct 2026) changed the order within groups. Score v2 (19 Oct 2026) introduced the evidence rules.