Compare five SCA tools for detecting malicious open-source packages, from behavioral analysis and install-time blocking to threat intelligence.