Runtime vs build. Runtime components ship inside your product (the CRA's concern). Build components (GitHub Actions, base images) only run in your pipeline — but a compromised one can inject anything into what ships.
Direct vs transitive. Direct = you chose it. Transitive = a dependency of a dependency; it enters "via" a direct one. You fix transitive risk by replacing/vendoring the direct entry point.
Jurisdiction (confidence-scored). Where the component's maintainers/governance plausibly sit legally. It is inferred intelligence, never asserted fact — the % is the engine's confidence. Unknown means exactly that.
Active maintainers — the approximate number of people actively maintaining the component (API field
bus_factor). 1 means one person is the whole supply chain.
how it's derived →
single — one active maintainer. Compromise or abandonment of one person breaks you (the
xz-utils backdoor pattern).
stale — no maintainer activity for 18+ months. Security fixes are unlikely to arrive.
relicense — a license with restrictive-relicensing history (Elastic, BUSL, SSPL). Redistribution terms can shift under you; review for
CRA.
handoff — documented maintainer handoff or compromise history for this component (the
tj-actions compromise pattern).
The jurisdiction vector. One package, four answers: legal control (who can be compelled — the main score), distribution (which registry it transits — npm/PyPI/Go proxy are all US-controlled), hosting (where the source lives), and maintainer geography. They routinely diverge: EU-authored code, US-distributed.
Floor vs ceiling. The US share is the *confirmed* figure; the ceiling shows what it becomes if every Unknown resolves to US. Honest bounds instead of false precision.
AI toolchain (declared tier). Agent config files (CLAUDE.md, copilot-instructions…) and AI co-author commit trailers make the model provider a build-chain supplier with its own jurisdiction. Declared evidence only — no statistical guessing about who wrote which line.
disputed — strong provenance signals point to different jurisdictions (e.g. US entity, EU maintainers). Reported as a finding with reduced confidence, never silently averaged.