Please take a look at the Linux Foundation's just published census of the security risks of open source projects. Truck factor would be a great addition.

https://github.com/linuxfoundation/cii-census