3 ms·

I would have thought it would show how big the dependency tree was.

• fmajid 2y ago
  And a count of historical CVEs in its transitive graph.
  • ChrisMarshallNY 2y ago
    CVEs might not be the best metric, alone. Many large, mature, and solid packages could have long histories of resolved CVEs.
    • hsbauauvhabzb 2y ago
      Yes but that would indicate deeply rooted issues in many cases.
      • ChrisMarshallNY 2y ago
        I would say "might," as opposed to "would." Big systems have big surfaces, no matter what quality they are. Dependency chains may be more of an issue. I think several of the last few big exploits have been compromises in fairly small packages, that were incorporated into larger ones. Then, there's the "Bro Coefficient." Who wrote the package should count for a lot. I'd trust a package written by "linus.torvalds," a lot more than one written by "L33tCoder420LOL," even if the Web site is super-sexy, and it has a gazillion GH stars.
    • fmajid 2y ago
      It's still a good measure of how much security risk you are taking from the increased attack surface.