SCA can only report a vulnerability for a component it can identify. It gathers evidence such as names and versions, maps that to an identifier, then looks up known issues. If identification fails, the result is silence, which looks like a clean bill of health. Vendored, renamed or hand copied code is the usual cause.
The matching chain
The OWASP Dependency-Check project documents one approach. Analyzers inspect dependencies and collect evidence. That evidence is used to find the dependency's CPE, a naming scheme for products. If a CPE is found, the report lists the CVE entries associated with it. Some technologies use extra sources too, such as package registry audit data. Vulnerability data comes from NVD feeds, and the project says that if no CPE is identified, no CVE entries are reported for that dependency.
Other tools match by package URL or ecosystem advisories instead. The idea is the same: no identity, no result.
Where identification breaks
- Vendored code. A library copied into your repository loses its package metadata.
- Renamed or forked packages. A fork published under a new name matches nothing.
- Bundled and minified files. A front end bundle can contain libraries with the names stripped.
- Binaries. Compiled artifacts may embed code without a manifest.
- Ambiguous names. Two products with similar names can produce wrong matches in either direction.
The last item also causes false positives, so matching quality affects both noise and misses.
How to check your own coverage
- Pick five dependencies you know have had advisories and confirm your tool reports them.
- List directories where third party code is copied in, and decide how each is tracked.
- Compare the tool's component count with a separate listing, such as your lockfile, and examine the gap.
- Ask whether the tool shows components it could not identify. Unknowns should be visible, not dropped.
What to do about gaps
Track vendored code in a manifest of your own, with source URL and version. Prefer package manager installs over copied files. Keep a software bill of materials that records provenance, so identification does not depend on guessing from file names.
Quick check
Is an empty SCA result proof of no vulnerabilities?
No. It may mean the component was not identified. Check that unknown components are reported.
Why do forks cause misses?
A renamed package does not match the identifiers in advisories for the original, even if the code is the same.
Sources
Last reviewed: 19 October 2026.
