Workshop: Scoring open-source dependencies to detect "weak links"