Scoring cloud packages for risk assessment automation

A non-transitory computer-readable medium having instructions stored thereon that are capable of causing a computer system to implement operations comprising:

• receiving a request that specifies a software package to a cloud-based application platform;
• calculating a risk score for the software package based on package metadata of the software package, wherein the package metadata includes namespace properties of a namespace of the software package;
• and
• determining, based on a comparison of the calculated risk score to a risk threshold, whether to permit distribution of the software package to users via the cloud-based application platform.

A method, comprising:

• receiving, by a computer system from a software developer, a request that specifies a software package for approval to an application exchange service of a cloud computer system;
• calculating, by the computer system, a risk score for the software package based on:
• package metadata of the software package;
• an analysis of code vulnerabilities of code included in components of the software package;
• and
• developer metadata associated with the software developer;
• and
• determining, by the computer system based on a comparison of the calculated risk score to a risk threshold, whether to permit distribution of the software package to users of the cloud computer system.