An apparatus for quantifying the security of an open-source software package and an apparatus and method for optimizing an open-source software package. The apparatus for optimizing an open-source software package includes a deletion target selection unit for creating a deletion target package list, which is a list of packages to be deleted from the total list of packages installed in a client, a package test unit for controlling the states of one or more virtual machines included in the client and receiving the result of performing a test case to which the deletion target package list is applied from the client, and a package optimization unit for creating an optimized package list based on the result of performing the test case.