LibVulnWatch: Vulnerability Assessment Leaderboard

LibVulnWatch – Continuous, Multi-Domain Risk Scoring for AI Libraries

As presented at the ACL 2025 Student Research Workshop and the ICML 2025 Technical AI Governance (TAIG) workshop, LibVulnWatch provides an evidence-based, end-to-end pipeline that uncovers hidden vulnerabilities in open-source AI libraries across five governance-aligned domains:

• License Validation – compatibility, provenance, obligations
• Security Assessment – CVEs, patch latency, exploit primitives
• Maintenance Health – bus-factor, release cadence, contributor diversity
• Dependency Management – transitive risk, SBOM completeness
• Regulatory Compliance – privacy/export controls, policy documentation

In the paper we apply the framework to 20 popular libraries, achieving 88 % coverage of OpenSSF Scorecard checks and surfacing up to 19 previously-unreported risks per library.
Lower scores indicate lower risk, and the Trust Score is the equal-weight average of the five domains.
{
  • "headers": [
    • "assessment_id",
    • "Type",
    • "T",
    • "Language",
    • "Framework",
    • "Library",
    • "Version",
    • "Trust Score",
    • "License",
    • "GitHub ⭐",
    • "Last Update",
    • "Verified",
    • "Active Maintenance",
    • "Report",
    • "License Rating",
    • "Security Rating",
    • "Maintenance Rating",
    • "Dependency Rating",
    • "Regulatory Rating",
    • "_languages_list",
    • "_maintenance_filter"
    ],
  • "data": [
    • [
      • "wandb_client_v0.15.13",
      • "ML Framework",
      • "🟢",
      • "Python",
      • "ML Framework",
      • "<a href="https://github.com/wandb/client" target="_blank">wandb/client</a>",
      • "v0.15.13",
      • 3.2,
      • "Permissive (similar to MIT/BSD) license with explicit patent grants",
      • 0,
      • "2025-07-01",
      • true,
      • true,
      • "<a href="https://seonglae-holistic.github.io/LibVulnWatch/wandb_client_vv0.15.13.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 4,
      • 1,
      • 5,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "pydantic_pydantic-ai_v0.3.2",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/pydantic/pydantic-ai" target="_blank">pydantic/pydantic-ai</a>",
      • "v0.3.2",
      • 3,
      • "MIT",
      • 10400,
      • "2024-06-08",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/pydantic_pydantic-ai_v0.3.2.html" target="_blank">View Report</a>",
      • 5,
      • 3,
      • 3,
      • 2,
      • 2,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "browser-use_browser-use_v0.3.2",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/browser-use/browser-use" target="_blank">browser-use/browser-use</a>",
      • "v0.3.2",
      • 3,
      • "MIT",
      • 3200,
      • "2024-06-09",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/browser_use_browser-use_v0.3.2.html" target="_blank">View Report</a>",
      • 5,
      • 3,
      • 3,
      • 2,
      • 2,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "huggingface_transformers_v4.52.4",
      • "ML Framework",
      • "🟢",
      • "Python",
      • "ML Framework",
      • "<a href="https://github.com/huggingface/transformers" target="_blank">huggingface/transformers</a>",
      • "v4.52.4",
      • 2.8,
      • "Apache-2.0",
      • 146000,
      • "2024-06-22",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/huggingface_transformers_v4.52.4.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 4,
      • 1,
      • 3,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "Lightning-AI_pytorch-lightning_v2.3.2",
      • "ML Framework",
      • "🟢",
      • "Python",
      • "ML Framework",
      • "<a href="https://github.com/lightning-ai/pytorch-lightning" target="_blank">Lightning-AI/pytorch-lightning</a>",
      • "v2.3.2",
      • 2.8,
      • "Apache-2.0",
      • 29700,
      • "2025-07-01",
      • true,
      • true,
      • "<a href="https://seonglae-holistic.github.io/LibVulnWatch/Lightning_AI_pytorch_lightning_vv2.3.2.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 4,
      • 1,
      • 3,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "jax-ml_jax_v0.4.23",
      • "ML Framework",
      • "🟢",
      • "Python",
      • "ML Framework",
      • "<a href="https://github.com/jax-ml/jax" target="_blank">jax-ml/jax</a>",
      • "v0.4.23",
      • 2.8,
      • "Apache-2.0",
      • 32604,
      • "2024-06-24",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/jax-ml_jax_v0.4.23.html" target="_blank">View Report</a>",
      • 5,
      • 3,
      • 4,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "pytorch_pytorch_v2.7.1",
      • "ML Framework",
      • "🟢",
      • "C++/Python",
      • "ML Framework",
      • "<a href="https://github.com/pytorch/pytorch" target="_blank">pytorch/pytorch</a>",
      • "v2.7.1",
      • 2.6,
      • "BSD-3-Clause",
      • 91000,
      • "2024-06-25",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/pytorch_pytorch_v2.7.1.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 3,
      • 1,
      • 3,
      • [
        • "C++",
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "tensorflow_tensorflow_v2.19.0",
      • "ML Framework",
      • "🟢",
      • "C++/Python",
      • "ML Framework",
      • "<a href="https://github.com/tensorflow/tensorflow" target="_blank">tensorflow/tensorflow</a>",
      • "v2.19.0",
      • 2.6,
      • "Apache-2.0",
      • 190000,
      • "2024-06-23",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/tensorflow_tensorflow_v2.19.0.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 3,
      • 1,
      • 3,
      • [
        • "C++",
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "onnx_onnx_v1.18.0",
      • "ML Framework",
      • "🟢",
      • "C++/Python",
      • "ML Framework",
      • "<a href="https://github.com/onnx/onnx" target="_blank">onnx/onnx</a>",
      • "v1.18.0",
      • 2.6,
      • "MIT",
      • 19100,
      • "2024-06-22",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/onnx_onnx_v1.18.0.html" target="_blank">View Report</a>",
      • 4,
      • 3,
      • 3,
      • 1,
      • 2,
      • [
        • "C++",
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "run-llama_llama_index_v0.12.43",
      • "LLM Orchestration",
      • "🟣",
      • "Python",
      • "LLM Orchestration",
      • "<a href="https://github.com/run-llama/llama_index" target="_blank">run-llama/llama_index</a>",
      • "v0.12.43",
      • 2.4,
      • "MIT",
      • 42500,
      • "2024-06-20",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/run-llama_llama_index_v0.12.43.html" target="_blank">View Report</a>",
      • 4,
      • 2,
      • 3,
      • 1,
      • 2,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "apache_mxnet_latest stable MXNet release: April 15, 2024",
      • "ML Framework",
      • "🟢",
      • "C++/Python",
      • "ML Framework",
      • "<a href="https://github.com/apache/mxnet" target="_blank">apache/mxnet</a>",
      • "latest stable MXNet release: April 15, 2024",
      • 2.4,
      • "Apache License 2.0",
      • 20801,
      • "2025-07-01",
      • true,
      • false,
      • "<a href="https://seonglae-holistic.github.io/LibVulnWatch/apache_mxnet_vlatest stable MXNet release: April 15, 2024.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 4,
      • 1,
      • 1,
      • [
        • "C++",
        • "Python"
        ],
      • "Inactive"
      ],
    • [
      • "google_adk-python_v1.4.2",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/google/adk-python" target="_blank">google/adk-python</a>",
      • "v1.4.2",
      • 2.4,
      • "MIT",
      • 3800,
      • "2024-06-07",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/google_adk-python_v1.4.2.html" target="_blank">View Report</a>",
      • 4,
      • 2,
      • 3,
      • 1,
      • 2,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "crewAIInc_crewAI_v0.130.0",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/crewaiinc/crewai" target="_blank">crewAIInc/crewAI</a>",
      • "v0.130.0",
      • 2.2,
      • "MIT",
      • 8200,
      • "2024-06-15",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/crewaiinc_crewai_v0.130.0.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 3,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "huggingface_datasets_3.6.0",
      • "ML Framework",
      • "🟢",
      • "Python",
      • "ML Framework",
      • "<a href="https://github.com/huggingface/datasets" target="_blank">huggingface/datasets</a>",
      • "3.6.0",
      • 2.2,
      • "Apache-2.0",
      • 20322,
      • "2025-07-02",
      • true,
      • true,
      • "<a href="https://seonglae-holistic.github.io/LibVulnWatch/huggingface_datasets_v3.6.0.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 3,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "huggingface_accelerate_v0.21.0",
      • "ML Framework",
      • "🟢",
      • "Python",
      • "ML Framework",
      • "<a href="https://github.com/huggingface/accelerate" target="_blank">huggingface/accelerate</a>",
      • "v0.21.0",
      • 2.2,
      • "Apache License 2.0",
      • 8889,
      • "2025-07-02",
      • true,
      • true,
      • "<a href="https://seonglae-holistic.github.io/LibVulnWatch/huggingface_accelerate_vv0.21.0.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 3,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "langchain-ai_langchain_v0.3.66",
      • "LLM Orchestration",
      • "🟣",
      • "Python",
      • "LLM Orchestration",
      • "<a href="https://github.com/langchain-ai/langchain" target="_blank">langchain-ai/langchain</a>",
      • "v0.3.66",
      • 2.2,
      • "MIT",
      • 111000,
      • "2024-06-17",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/langchain-ai_langchain_v0.3.66.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 1,
      • 1,
      • 3,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "vllm-project_vllm_v0.9.1",
      • "LLM Inference",
      • "🟦",
      • "Python/CUDA",
      • "LLM Inference",
      • "<a href="https://github.com/vllm-project/vllm" target="_blank">vllm-project/vllm</a>",
      • "v0.9.1",
      • 2.2,
      • "Apache-2.0",
      • 50600,
      • "2024-06-18",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/vllm-project_vllm_v0.9.1.html" target="_blank">View Report</a>",
      • 4,
      • 2,
      • 3,
      • 1,
      • 1,
      • [
        • "Python",
        • "CUDA"
        ],
      • "Active"
      ],
    • [
      • "nvidia_TensorRT_v10.12.0",
      • "ML Framework",
      • "🟢",
      • "C++/Python",
      • "ML Framework Inference",
      • "<a href="https://github.com/nvidia/tensorrt" target="_blank">nvidia/TensorRT</a>",
      • "v10.12.0",
      • 2.2,
      • "Proprietary with Open Components",
      • 11700,
      • "2024-06-21",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/nvidia_tensorrt_v10.12.0.html" target="_blank">View Report</a>",
      • 3,
      • 2,
      • 3,
      • 1,
      • 2,
      • [
        • "C++",
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "sgl-project_sglang_v0.4.7",
      • "LLM Inference",
      • "🟦",
      • "Python/C++",
      • "LLM Inference",
      • "<a href="https://github.com/sgl-project/sglang" target="_blank">sgl-project/sglang</a>",
      • "v0.4.7",
      • 2.2,
      • "Apache-2.0",
      • 15400,
      • "2024-06-19",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/sgl-project_sglang_v0.4.7.html" target="_blank">View Report</a>",
      • 4,
      • 2,
      • 3,
      • 1,
      • 1,
      • [
        • "Python",
        • "C++"
        ],
      • "Active"
      ],
    • [
      • "ComposableHQ_composio_v0.7.19",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/composablehq/composio" target="_blank">ComposableHQ/composio</a>",
      • "v0.7.19",
      • 2,
      • "MIT",
      • 1200,
      • "2024-06-10",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/ComposableHQ_composio_v0.7.19.html" target="_blank">View Report</a>",
      • 4,
      • 2,
      • 2,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "triton-inference-server_server_2.59.0",
      • "ML Framework",
      • "🟢",
      • "C++/Python",
      • "ML Framework",
      • "<a href="https://github.com/triton-inference-server/server" target="_blank">triton-inference-server/server</a>",
      • "2.59.0",
      • 2,
      • "BSD and Apache-2.0 with some CeCILL-B components",
      • 9400,
      • "2025-07-01",
      • true,
      • true,
      • "<a href="https://seonglae-holistic.github.io/LibVulnWatch/triton-inference-server_server_v2.59.0.html" target="_blank">View Report</a>",
      • 4,
      • 1,
      • 3,
      • 1,
      • 1,
      • [
        • "C++",
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "huggingface_smolagents_v1.19.0",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/huggingface/smolagents" target="_blank">huggingface/smolagents</a>",
      • "v1.19.0",
      • 2,
      • "MIT",
      • 20500,
      • "2024-06-12",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/huggingface_smolagents_v1.19.0.html" target="_blank">View Report</a>",
      • 4,
      • 2,
      • 2,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "FoundationAgents_MetaGPT_v0.8.1",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/foundationagents/metagpt" target="_blank">FoundationAgents/MetaGPT</a>",
      • "v0.8.1",
      • 2,
      • "MIT",
      • 56700,
      • "2024-06-14",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/foundationagents_metagpt_v0.8.1.html" target="_blank">View Report</a>",
      • 4,
      • 2,
      • 2,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "browserbase_stagehand_v2.3.1",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/browserbase/stagehand" target="_blank">browserbase/stagehand</a>",
      • "v2.3.1",
      • 2,
      • "Apache-2.0 with Commons Clause",
      • 12800,
      • "2024-06-11",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/browserbase_stagehand_v2.3.1.html" target="_blank">View Report</a>",
      • 3,
      • 2,
      • 3,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "openai_swarm_No formal releases",
      • "Agent Framework",
      • "⭕",
      • "Unknown",
      • "Agent Framework",
      • "<a href="https://github.com/openai/swarm" target="_blank">openai/swarm</a>",
      • "No formal releases",
      • 1.8,
      • "MIT",
      • 20011,
      • "2025-07-01",
      • true,
      • false,
      • "<a href="https://seonglae-holistic.github.io/LibVulnWatch/openai_swarm_vNo formal releases.html" target="_blank">View Report</a>",
      • 5,
      • 1,
      • 1,
      • 1,
      • 1,
      • [
        • "Unknown"
        ],
      • "Inactive"
      ],
    • [
      • "huggingface_text-generation-inference_v3.3.4",
      • "LLM Inference",
      • "🟦",
      • "Rust/Python",
      • "LLM Inference",
      • "<a href="https://github.com/huggingface/text-generation-inference" target="_blank">huggingface/text-generation-inference</a>",
      • "v3.3.4",
      • 1.8,
      • "Apache-2.0",
      • 10200,
      • "2024-06-16",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/huggingface_text-generation-inference_v3.3.4.html" target="_blank">View Report</a>",
      • 3,
      • 2,
      • 2,
      • 1,
      • 1,
      • [
        • "Rust",
        • "Python"
        ],
      • "Active"
      ],
    • [
      • "langchain-ai_langgraph_v2.1.0",
      • "Agent Framework",
      • "⭕",
      • "Python",
      • "Agent Framework",
      • "<a href="https://github.com/langchain-ai/langgraph" target="_blank">langchain-ai/langgraph</a>",
      • "v2.1.0",
      • 1.6,
      • "Proprietary",
      • 14700,
      • "2024-06-13",
      • true,
      • true,
      • "<a href="https://981526092.github.io/LibVulnWatch/langchain-ai_langgraph_v2.1.0.html" target="_blank">View Report</a>",
      • 1,
      • 1,
      • 4,
      • 1,
      • 1,
      • [
        • "Python"
        ],
      • "Active"
      ]
    ],
  • "metadata": null
}