Why Your SCA is Always Wrong | Endor Labs

Dimitri Stiliadis of Endor Labs explains why traditional software composition analysis tools produce so many false positives (and sometimes false negatives), especially for Python and JavaScript. The root cause is that in most languages the package manager and the compiler or runtime operate in isolation—"like ships in the night"—so dependency definitions are human-driven and the runtime never checks them. Because most SCA tools simply scan the file system for manifest files, parse them, assume the declared dependencies match what the code actually uses, build a dependency graph, and generate an SBOM with vulnerability analysis, they miss four situations: phantom dependencies (packages imported in code but not declared, causing false negatives), misused dependency scopes (dev or test dependencies actually used at runtime), direct use of transitive dependencies (leading to wrong severity and remediation advice), and unused dependencies (declared but never used, causing false positives). Go is cited as an exception where package management and the compiler are integrated. The post argues an ideal SCA tool should treat source code as ground truth, correlate it with package manager data and the file system, and highlight discrepancies—concluding that SCA grounded in program analysis is the right approach. 

https://www.endorlabs.com/learn/why-are-all-sca-tools-wrong