transitive-dependencies
Safeguard articles tagged "transitive-dependencies" — guides, analysis, and best practices for software supply chain and application security.
26 articles
What to Do With a Critical Vulnerability That Has No Fix
Every remediation process assumes a patch exists. When the maintainer is gone and the package sits three levels deep in a tree you do not control, you need a different workflow: narrow the exposure, then decide, document, control and expire.
@angular-devkit/build-angular: A Security Guide to the Angular Build Package
@angular-devkit/build-angular is the build toolchain behind the Angular CLI. Most of its security risk is transitive, coming from the build and dev-server dependencies it pulls in.
Managing Transitive Dependencies: The Vulnerabilities You Didn't Choose
Most dependency risk lives in packages you never installed directly. Here is how transitive dependencies work across ecosystems and how to audit and control them.
The Moq NuGet incident: how a mocking library harvested developer emails
In August 2023, Moq v4.20.0 quietly ran git config at build time and phoned home 10,356 times before anyone pulled it — via a dependency nobody vetted.
Untracked Dependencies in the Software Supply Chain
Most teams can name their direct dependencies but not the hundreds of transitive packages actually running underneath. Here's why that gap is where real supply chain attacks live.
Transitive Dependency Risk Explained: The Code You Never Chose
Transitive dependencies are the packages your dependencies pull in, and they make up most of your codebase. Here is why they are risky and how to manage them.
event-stream npm package backdoor incident
How a routine maintainer handoff let attackers slip a Bitcoin-stealing backdoor into event-stream, hitting millions of npm installs for ten weeks.
Dependency Management: Frequently Asked Questions
A practical FAQ on managing software dependencies in 2026 — direct vs transitive, lockfiles, semantic versioning, safe updates, dependency confusion, and keeping trees clean.
Understanding Dependency Trees
The libraries you install are only the tip of the iceberg. Each one pulls in its own dependencies, which pull in more, forming a tree that can run hundreds of packages deep. Understanding that tree is the first step to securing it.
Lessons from Log4Shell: How One Logging Call Became the Internet's Worst Weekend
CVE-2021-44228 let an unauthenticated attacker run code by getting a single string logged. Here is how Log4Shell worked, why it was everywhere, and what actually contained it.
regenerator-runtime: What It Is and Whether to Worry
regenerator-runtime shows up in thousands of dependency trees, usually transitively. Here is what it does, why it is there, and how to think about its risk.
Snyk and Log4j: Finding and Fixing Log4Shell in Your Dependencies
Snyk can detect the Log4Shell family of Log4j vulnerabilities across your dependency tree, including transitive ones. Here is what it finds, how the fix path works, and the limits to know.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.