Automatically detecting and mitigating risks associated with installing a software package on a computer system

A non-transitory computer-readable medium comprising program code that is executable by one or more processors for causing the one or more processors to perform operations including:

• receiving, by one or more processors, a request associated with installing a software package on a computing device, wherein the software package includes a plurality of software components;
• and
• in response to receiving the request:
• generating, by the one or more processors, a plurality of severity scores for the plurality of software components, each severity score of the plurality of severity scores corresponding to a respective software component of the plurality of software components and indicating a severity of one or more vulnerabilities associated with the respective software component;
• generating, by the one or more processors, a risk score for the software package based on the plurality of severity scores, the risk score representing an overall level of risk associated with installing the software package on the computing device;
• determining, by the one or more processors, that an alternative software component is correlated in a predefined mapping with a particular software component of the plurality of software components;
• determining, by the one or more processors, a first severity score for the particular software component, the first severity score being among the plurality of severity scores;
• determining, by the one or more processors, a second severity score for the alternative software component;
• determining that the second severity score is lower than the first severity score;
• and
• outputting, by the one or more processors, and prior to the computing device installing the software package, a notification indicating the risk score and the alternative software component.

A system comprising:

• one or more processors;
• and
• one or more memories including program code that is executable by the one or more processors for causing the one or more processors to perform operations including:
• receiving, by one or more processors, a request associated with installing a software package on a computing device, wherein the software package includes a plurality of software components;
• and
• in response to receiving the request:
• generating, by the one or more processors, a plurality of severity scores for the plurality of software components, each severity score of the plurality of severity scores corresponding to a respective software component of the plurality of software components and indicating a severity of one or more vulnerabilities associated with the respective software component;
• generating, by the one or more processors, a risk score for the software package based on the plurality of severity scores, the risk score representing an overall level of risk associated with installing the software package on the computing device;
• determining, by the one or more processors, that an alternative software component is correlated in a predefined mapping with a particular software component of the plurality of software components;
• determining, by the one or more processors, a first severity score for the particular software component, the first severity score being among the plurality of severity scores;
• determining, by the one or more processors, a second severity score for the alternative software component;
• determining that the second severity score is lower than the first severity score;
• and
• outputting, by the one or more processors, and prior to the computing device installing the software package, a notification indicating the risk score and the alternative software component.