Tenant (UI) workflow

How to access the Package Explorer

• Navigate to Modules > Supply Chain Security > Package Explorer. The Package Explorer includes top-line summary widgets followed by a detailed package table.

Review the top-line widgets

The summary widgets at the top of the page display high-level metrics for the packages in your current scope. Review these widgets for a general summary, then use the table filters below to isolate and investigate specific packages.

• Stage distribution (pie chart): Shows how packages are distributed across the Code, Deploy, and Runtime stages
• High-Risk Packages: Counts packages currently classified as high operational risk and breaks the population down by risk level (for example, Low, Medium, High, and N/A). Operational Risk is the primary input to this widget; packages without an Operational Risk value (such as OS packages) are counted as N/A
• Packages Highlights: Displays packages that are flagged as malicious or deprecated

Understand the package table

Each row describes a specific package and version (for example, supershell@v1.0.3). By default, the table is ordered by package Name, then by Version, and displays a default set of columns. Additional columns are available but hidden by default.

• Default columns: Name, Version, Package Type (Application or Operating System), Package Manager, Insights, Used In, and a Vulnerabilities severity bar
• Package Type column: Indicates whether the row is an Application package or an Operating System (OS)package. CAS contributes OSS packages only; CWP contributes both OSS and OS packages
• Insights column: Flags package-level posture signals; Malicious, Deprecated, or both. Insights are distinct from CVE vulnerabilities
• Vulnerabilities column (severity bar): Displays CVE issue counts by severity. The counts are links. Selecting a count redirects to the CAS Vulnerabilities Issues page, which includes both CAS and CWP vulnerabilities, filtered by the Package Name and Package Version of the selected row
• Used In column: Aggregates usage across Code, Deploy, and Runtime, and distinguishes the three stages

NOTE: For the complete list of default and hidden columns, refer to Reference A: Package table columns.

Search, filter, and sort the inventory

You can search, filter, and sort the table by every field.

• Use the column filters to narrow the inventory by any field (for example, Package Type, Package Manager, Operational Risk, or Insights)
• To find a package by name or version, enter a search term. Package Name and Version support both exact and fuzzy matching
• To search across a span of versions, enter a version range
• Select a column header to sort by that column. The default sort is by Name, then by Version

What happens next: The table updates to show only the packages that match the active search and filter criteria, reordered by the selected column.

Inspect a package in the side card

Selecting a package row opens a side card dedicated to that package. The side card contains an Overview tab and a Vulnerabilities tab.

1. Select a package row in the table. The package side card opens to the Overview tab.
2. Select the Vulnerabilities tab to review the package CVE issues, separated into Code, Deployed, and Runtime tables.

Overview tab

The Overview tab presents the package identity, organizational impact, usage locations, and operational risk, and offers alternative packages.

• Package identity: The top of the Overview tab shows the Asset type (Software Package), the Asset subtype (code language) (for example, Python Package), and the full package name and language icon (for example, supershell@v1.0.3)
• Highlights: Provides a plain-language summary of the package risk posture (for example, why the package carries High operational risk). The Highlights section also displays the package Risk badge and key lifecycle timestamps (First Seen, Last Seen, Last Updated, and Package metadata as of)
• Organizational impact (Used in count): Shows the overall number of assets, by software development stage, in which the package was found, with a split between Code (number of repositories), Deploy (number of registry images), and Runtime (number of runtime images, VM instances and serverless functions)
• Used In table: Details the specific locations of the package across the organization and supports filtering on all of its fields. In the Used In table, the Package Type column represents the Dependency Type (for example, direct or transitive) of the package on that asset. Selecting an asset row in the Used In table opens the asset side card details in place, without navigating away from the package side card. For the complete list of Used In table columns, refer to Reference B: Used In table columns
• Operational Risk section: Displays an overall risk rating (for example, High) and breaks the rating down into Popularity and Maintenance metric groups, each with its own sub-rating. NOTE: Operational Risk is populated for Application packages sourced from Application Security only; Operating System packages do not carry Operational Risk

Vulnerabilities tab

The Vulnerabilities tab presents the CVE issues for the package. The tab organizes the package CVE issues into three tables that separate the issues by software development stage:

• Code issues : CVE issues discovered in source repositories
• Deployed issues: CVE issues discovered in registry images and other deployed artifacts
• Runtime issues: CVE issues discovered in VMs, containers, and serverless functions

Each table supports standard filtering and ordering on all of its columns and links each CVE back to the affected assets. This separation connects each CVE to its Code-to-Cloud footprint so you can prioritize the vulnerabilities that reach deployed and running workloads. NOTE: Vulnerabilities in this tab are CVE issues only; they do not include other finding types or threat-intelligence signals.