New report offers valuable resource to help organizations evaluate the safety and reliability of open-source packages.