dep-brain 1.3.0 → 1.4.0

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 All notable changes to this project will be documented in this file.
 
+## 1.4.0
+
+- Added lockfile dependency-edge parsing so transitive relationships are available from npm, pnpm, and yarn lockfiles.
+- Changed risk analysis from direct-package-only output to direct-owner risk summaries with `transitiveRiskScore` and `riskyTransitiveDeps`.
+- Added transitive dependency counts and risky transitive counts to `riskFactors`.
+- Updated console, markdown, and dashboard reports to highlight transitive risk hotspots.
+- Bumped analysis output contract to `1.5` and added regression coverage for transitive risk propagation.
+
 ## 1.3.0
 
 - Added plugin diagnostics under `extensions.depBrain.plugins` for failed plugin loads and hook errors.

package/README.md

@@ -21,6 +21,7 @@
 - Detect likely unused dependencies from source imports and scripts
 - Detect outdated packages
 - Highlight dependency risk signals
+- Show which direct dependency introduces risky transitive packages
 - Score package trust using supply-chain metadata
 - Generate a simple project health score
 - Output reports in console, JSON, Markdown, SARIF, dashboard, and top-issues formats
@@ -39,6 +40,7 @@ The long-term goal is not just to list problems, but to answer:
 - Unused dependency detection with runtime vs dev-tool heuristics
 - Outdated dependency reporting with `major`, `minor`, and `patch` classification
 - Risk analysis based on npm package metadata
+- Transitive risk ownership and path tracing for direct dependencies
 - Confidence scores, reason codes, explanations, and recommendations for findings
 - Config loading from `depbrain.config.json`
 - Ignore rules for noisy dependencies and checks
@@ -379,7 +381,7 @@ src/
 
 The project should optimize for trust, clarity, and actionability over flashy UI, generic graphs, or simply adding more checks.
 
-Risk findings now include a `trustScore` plus structured `riskFactors` such as publish recency, maintainer count, and repository presence.
+Risk findings now include a `trustScore`, structured `riskFactors`, `transitiveRiskScore`, and `riskyTransitiveDeps` path traces so teams can see which direct package introduces supply-chain risk.
 
 ## Repository Notes
 

package/depbrain.output.schema.json

@@ -19,7 +19,7 @@
     },
     "riskFactors": {
       "type": "object",
-      "required": ["daysSincePublish", "downloads", "maintainersCount", "versionCount", "recentReleaseCount", "hasRepository", "dependencyType"],
+      "required": ["daysSincePublish", "downloads", "maintainersCount", "versionCount", "recentReleaseCount", "hasRepository", "dependencyType", "transitiveDependencyCount", "riskyTransitiveCount"],
       "additionalProperties": false,
       "properties": {
         "daysSincePublish": { "type": ["number", "null"] },
@@ -28,7 +28,21 @@
         "versionCount": { "type": ["number", "null"] },
         "recentReleaseCount": { "type": ["number", "null"] },
         "hasRepository": { "type": "boolean" },
-        "dependencyType": { "type": "string", "enum": ["dependencies", "devDependencies", "unknown"] }
+        "dependencyType": { "type": "string", "enum": ["dependencies", "devDependencies", "unknown"] },
+        "transitiveDependencyCount": { "type": "number" },
+        "riskyTransitiveCount": { "type": "number" }
+      }
+    },
+    "riskTransitiveDependency": {
+      "type": "object",
+      "required": ["name", "trustScore", "confidence", "reasons", "introducedByPaths"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "trustScore": { "type": "string", "enum": ["high", "medium", "low"] },
+        "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+        "reasons": { "type": "array", "items": { "type": "string" } },
+        "introducedByPaths": { "type": "array", "items": { "type": "string" } }
       }
     },
     "ownershipSummary": {
@@ -159,7 +173,7 @@
       "type": "array",
       "items": {
         "type": "object",
-        "required": ["name", "reasons", "confidence", "reasonCodes", "explanation", "trustScore", "riskFactors", "recommendation"],
+        "required": ["name", "reasons", "confidence", "reasonCodes", "explanation", "trustScore", "riskFactors", "transitiveRiskScore", "riskyTransitiveDeps", "recommendation"],
         "additionalProperties": false,
         "properties": {
           "name": { "type": "string" },
@@ -170,6 +184,11 @@
           "explanation": { "type": "array", "items": { "type": "string" } },
           "trustScore": { "type": "string", "enum": ["high", "medium", "low"] },
           "riskFactors": { "$ref": "#/properties/riskFactors" },
+          "transitiveRiskScore": { "type": "number" },
+          "riskyTransitiveDeps": {
+            "type": "array",
+            "items": { "$ref": "#/properties/riskTransitiveDependency" }
+          },
           "recommendation": { "$ref": "#/properties/recommendation" }
         }
       }

package/dist/checks/risk.js

@@ -1,11 +1,14 @@
 import { getPackageMetadata } from "../utils/npm-api.js";
 export async function findRiskDependencies(graph, options = {}) {
     const resolvePackageMetadata = options.resolvePackageMetadata ?? getPackageMetadata;
-    const names = Object.keys({
+    const thresholds = options.thresholds;
+    const allNames = Object.keys({
         ...graph.dependencies,
-        ...graph.devDependencies
+        ...graph.devDependencies,
+        ...(graph.lockPackages ?? {})
     });
-    const results = await mapWithConcurrency(names, 8, async (name) => {
+    const assessments = new Map();
+    const results = await mapWithConcurrency(allNames, 8, async (name) => {
         const metadata = await resolvePackageMetadata(name);
         if (!metadata) {
             return null;
@@ -15,24 +18,25 @@ export async function findRiskDependencies(graph, options = {}) {
             : graph.devDependencies[name]
                 ? "devDependencies"
                 : "unknown";
-        const assessment = assessRisk(metadata, dependencyType, options.thresholds);
-        if (!shouldReportRisk(assessment.trustScore, dependencyType)) {
-            return null;
-        }
+        const assessment = assessRisk(metadata, dependencyType, thresholds, 0);
         return {
             name,
-            reasons: assessment.reasons,
-            confidence: assessment.confidence,
-            reasonCodes: assessment.reasonCodes,
-            explanation: assessment.reasons,
-            trustScore: assessment.trustScore,
-            riskFactors: assessment.riskFactors,
-            recommendation: buildRiskRecommendation(assessment.reasons, assessment.confidence, assessment.trustScore)
+            assessment
         };
     });
-    return results
-        .filter((item) => item !== null)
-        .sort((left, right) => left.name.localeCompare(right.name));
+    for (const result of results) {
+        if (result) {
+            assessments.set(result.name, result.assessment);
+        }
+    }
+    const directNames = Object.keys({
+        ...graph.dependencies,
+        ...graph.devDependencies
+    }).sort((left, right) => left.localeCompare(right));
+    const risks = directNames
+        .map((name) => buildDirectRiskEntry(name, graph, assessments, thresholds))
+        .filter((item) => item !== null);
+    return risks.sort((left, right) => left.name.localeCompare(right.name));
 }
 async function mapWithConcurrency(items, limit, mapper) {
     const results = new Array(items.length);
@@ -68,12 +72,120 @@ export async function runRiskCheck(graph, options = {}) {
                 name: item.name,
                 reasons: item.reasons,
                 trustScore: item.trustScore,
-                riskFactors: item.riskFactors
+                riskFactors: item.riskFactors,
+                transitiveRiskScore: item.transitiveRiskScore,
+                riskyTransitiveDeps: item.riskyTransitiveDeps
             }
         }))
     };
 }
-function assessRisk(metadata, dependencyType, thresholds) {
+function buildDirectRiskEntry(name, graph, assessments, thresholds) {
+    const dependencyType = graph.dependencies[name]
+        ? "dependencies"
+        : graph.devDependencies[name]
+            ? "devDependencies"
+            : "unknown";
+    const selfAssessment = assessments.get(name) ?? buildUnknownAssessment(name, dependencyType);
+    const transitive = collectTransitiveRisks(name, graph, assessments);
+    const reasonCodes = [...selfAssessment.reasonCodes];
+    const reasons = [...selfAssessment.reasons];
+    const explanation = [...selfAssessment.reasons];
+    if (transitive.riskyTransitiveDeps.length > 0) {
+        reasons.push(`Introduces ${transitive.riskyTransitiveDeps.length} risky transitive dependenc${transitive.riskyTransitiveDeps.length === 1 ? "y" : "ies"}`);
+        reasonCodes.push("risky_transitive_dependencies");
+        explanation.push(`Transitive paths: ${transitive.riskyTransitiveDeps
+            .flatMap((item) => item.introducedByPaths)
+            .slice(0, 3)
+            .join("; ")}`);
+    }
+    if (transitive.transitiveDependencyCount > (thresholds?.transitiveBloatThreshold ?? 50)) {
+        reasons.push("Large transitive dependency tree");
+        reasonCodes.push("dependency_bloat");
+        explanation.push(`${name} introduces ${transitive.transitiveDependencyCount} transitive dependencies.`);
+    }
+    const transitiveRiskScore = transitive.riskyTransitiveDeps.reduce((total, item) => total + trustScoreWeight(item.trustScore), 0);
+    const combinedConfidence = Math.min(0.99, Math.max(selfAssessment.confidence, transitive.riskyTransitiveDeps.reduce((maxConfidence, item) => Math.max(maxConfidence, item.confidence), 0.5)));
+    const trustScore = combineTrustScores(selfAssessment.trustScore, transitive.highestTrustScore);
+    const shouldReport = shouldReportRisk(selfAssessment.trustScore, dependencyType) ||
+        transitive.riskyTransitiveDeps.length > 0 ||
+        transitive.transitiveDependencyCount > (thresholds?.transitiveBloatThreshold ?? 50);
+    if (!shouldReport || reasons.length === 0) {
+        return null;
+    }
+    return {
+        name,
+        reasons,
+        confidence: combinedConfidence,
+        reasonCodes: dedupeStrings(reasonCodes),
+        explanation: dedupeStrings(explanation),
+        trustScore,
+        riskFactors: {
+            ...selfAssessment.riskFactors,
+            dependencyType,
+            transitiveDependencyCount: transitive.transitiveDependencyCount,
+            riskyTransitiveCount: transitive.riskyTransitiveDeps.length
+        },
+        transitiveRiskScore,
+        riskyTransitiveDeps: transitive.riskyTransitiveDeps,
+        recommendation: buildRiskRecommendation(reasons, combinedConfidence, trustScore, transitive.riskyTransitiveDeps.length)
+    };
+}
+function collectTransitiveRisks(directName, graph, assessments) {
+    const visited = new Set();
+    const queue = (graph.lockDependencies?.[directName] ?? []).map((name) => ({
+        name,
+        path: [directName, name]
+    }));
+    const riskyByName = new Map();
+    let highestTrustScore = "high";
+    while (queue.length > 0) {
+        const current = queue.shift();
+        if (!current || visited.has(current.name)) {
+            continue;
+        }
+        visited.add(current.name);
+        const assessment = assessments.get(current.name);
+        if (assessment && shouldReportRisk(assessment.trustScore, assessment.riskFactors.dependencyType)) {
+            highestTrustScore = combineTrustScores(highestTrustScore, assessment.trustScore);
+            const existing = riskyByName.get(current.name);
+            const pathTrace = current.path.join(" -> ");
+            if (existing) {
+                existing.introducedByPaths.push(pathTrace);
+            }
+            else {
+                riskyByName.set(current.name, {
+                    name: current.name,
+                    trustScore: assessment.trustScore,
+                    confidence: assessment.confidence,
+                    reasons: assessment.reasons,
+                    introducedByPaths: [pathTrace]
+                });
+            }
+        }
+        const nextDependencies = graph.lockDependencies?.[current.name] ?? [];
+        for (const dependency of nextDependencies) {
+            if (!visited.has(dependency)) {
+                queue.push({
+                    name: dependency,
+                    path: [...current.path, dependency]
+                });
+            }
+        }
+    }
+    return {
+        transitiveDependencyCount: visited.size,
+        riskyTransitiveDeps: Array.from(riskyByName.values())
+            .map((item) => ({
+            ...item,
+            introducedByPaths: dedupeStrings(item.introducedByPaths).slice(0, 3)
+        }))
+            .sort((left, right) => trustScoreWeight(right.trustScore) - trustScoreWeight(left.trustScore) ||
+            right.confidence - left.confidence ||
+            left.name.localeCompare(right.name)),
+        highestTrustScore
+    };
+}
+function assessRisk(metadata, dependencyType, thresholds, transitiveDependencyCount) {
     const reasons = [];
     const reasonCodes = [];
     let weight = 0;
@@ -127,6 +239,7 @@ function assessRisk(metadata, dependencyType, thresholds) {
             ? "medium"
             : "high";
     return {
+        name: "",
         confidence,
         trustScore,
         reasons,
@@ -138,7 +251,29 @@ function assessRisk(metadata, dependencyType, thresholds) {
             versionCount: metadata.versionCount,
             recentReleaseCount: metadata.recentReleaseCount,
             hasRepository: Boolean(metadata.repository),
-            dependencyType
+            dependencyType,
+            transitiveDependencyCount,
+            riskyTransitiveCount: 0
+        }
+    };
+}
+function buildUnknownAssessment(name, dependencyType) {
+    return {
+        name,
+        confidence: 0.5,
+        trustScore: "high",
+        reasons: [],
+        reasonCodes: [],
+        riskFactors: {
+            daysSincePublish: null,
+            downloads: null,
+            maintainersCount: null,
+            versionCount: null,
+            recentReleaseCount: null,
+            hasRepository: false,
+            dependencyType,
+            transitiveDependencyCount: 0,
+            riskyTransitiveCount: 0
         }
     };
 }
@@ -160,14 +295,33 @@ function shouldReportRisk(trustScore, dependencyType) {
     }
     return true;
 }
-function buildRiskRecommendation(reasons, confidence, trustScore) {
+function buildRiskRecommendation(reasons, confidence, trustScore, riskyTransitiveCount) {
     return {
         action: "review",
-        priority: trustScore === "low" || confidence >= 0.8 ? "high" : "medium",
+        priority: trustScore === "low" || confidence >= 0.8 || riskyTransitiveCount >= 2
+            ? "high"
+            : "medium",
         safety: "caution",
-        summary: trustScore === "low"
-            ? "Low trust package; review whether to replace, pin, or monitor it closely."
-            : "Review package trust signals and decide whether to keep, replace, or monitor it.",
+        summary: riskyTransitiveCount > 0
+            ? `Review this direct dependency and its transitive chain before upgrading or keeping it.`
+            : trustScore === "low"
+                ? "Low trust package; review whether to replace, pin, or monitor it closely."
+                : "Review package trust signals and decide whether to keep, replace, or monitor it.",
         reasons
     };
 }
+function trustScoreWeight(value) {
+    if (value === "low") {
+        return 3;
+    }
+    if (value === "medium") {
+        return 2;
+    }
+    return 1;
+}
+function combineTrustScores(left, right) {
+    return trustScoreWeight(left) >= trustScoreWeight(right) ? left : right;
+}
+function dedupeStrings(values) {
+    return Array.from(new Set(values));
+}

package/dist/core/analyzer.d.ts

@@ -43,8 +43,17 @@ export interface RiskFactors {
     recentReleaseCount: number | null;
     hasRepository: boolean;
     dependencyType: "dependencies" | "devDependencies" | "unknown";
+    transitiveDependencyCount: number;
+    riskyTransitiveCount: number;
 }
 export type TrustScore = "high" | "medium" | "low";
+export interface RiskTransitiveDependency {
+    name: string;
+    trustScore: TrustScore;
+    confidence: number;
+    reasons: string[];
+    introducedByPaths: string[];
+}
 export interface DuplicateDependency {
     name: string;
     versions: string[];
@@ -85,6 +94,8 @@ export interface RiskDependency {
     explanation: string[];
     trustScore: TrustScore;
     riskFactors: RiskFactors;
+    transitiveRiskScore: number;
+    riskyTransitiveDeps: RiskTransitiveDependency[];
     recommendation: Recommendation;
 }
 export interface TopIssue {
@@ -133,7 +144,7 @@ export interface PackageAnalysisResult {
     topIssues: TopIssue[];
     extensions: Record<string, unknown>;
 }
-export declare const OUTPUT_VERSION = "1.4";
+export declare const OUTPUT_VERSION = "1.5";
 export interface ScoreBreakdown {
     baseScore: number;
     duplicates: number;

package/dist/core/analyzer.js

@@ -9,7 +9,7 @@ import { buildDependencyGraph } from "./graph-builder.js";
 import { PluginManager } from "./plugin-manager.js";
 import { calculateHealthScore, calculateScoreDeductions } from "./scorer.js";
 import { buildAnalysisContext } from "./context.js";
-export const OUTPUT_VERSION = "1.4";
+export const OUTPUT_VERSION = "1.5";
 export async function analyzeProject(options = {}) {
     const rootDir = path.resolve(options.rootDir ?? process.cwd());
     const loadedConfig = await loadDepBrainConfig(rootDir, options.configPath);
@@ -396,6 +396,10 @@ function mapRiskIssues(issues) {
         explanation: normalizeStringArray(issue.explanation),
         trustScore: normalizeTrustScore(issue.meta?.trustScore),
         riskFactors: normalizeRiskFactors(issue.meta?.riskFactors),
+        transitiveRiskScore: typeof issue.meta?.transitiveRiskScore === "number"
+            ? issue.meta.transitiveRiskScore
+            : 0,
+        riskyTransitiveDeps: normalizeRiskTransitiveDependencies(issue.meta?.riskyTransitiveDeps),
         recommendation: buildRiskRecommendation(issue)
     }));
 }
@@ -459,13 +463,18 @@ function buildRiskRecommendation(issue) {
     const reasons = normalizeStringArray(issue.explanation);
     const confidence = normalizeConfidence(issue.confidence);
     const trustScore = normalizeTrustScore(issue.meta?.trustScore);
+    const riskyTransitiveDeps = normalizeRiskTransitiveDependencies(issue.meta?.riskyTransitiveDeps);
     return {
         action: "review",
-        priority: trustScore === "low" || confidence >= 0.79 ? "high" : "medium",
+        priority: trustScore === "low" || confidence >= 0.79 || riskyTransitiveDeps.length >= 2
+            ? "high"
+            : "medium",
         safety: "caution",
-        summary: trustScore === "low"
-            ? "Low trust package; review whether to replace, pin, or monitor it closely."
-            : "Review package trust signals and decide whether to keep, replace, or monitor it.",
+        summary: riskyTransitiveDeps.length > 0
+            ? "Review this direct dependency and its transitive chain before upgrading or keeping it."
+            : trustScore === "low"
+                ? "Low trust package; review whether to replace, pin, or monitor it closely."
+                : "Review package trust signals and decide whether to keep, replace, or monitor it.",
         reasons
     };
 }
@@ -604,7 +613,9 @@ function normalizeRiskFactors(value) {
             versionCount: null,
             recentReleaseCount: null,
             hasRepository: false,
-            dependencyType: "unknown"
+            dependencyType: "unknown",
+            transitiveDependencyCount: 0,
+            riskyTransitiveCount: 0
         };
     }
     const factors = value;
@@ -617,9 +628,38 @@ function normalizeRiskFactors(value) {
         hasRepository: factors.hasRepository === true,
         dependencyType: factors.dependencyType === "dependencies" || factors.dependencyType === "devDependencies"
             ? factors.dependencyType
-            : "unknown"
+            : "unknown",
+        transitiveDependencyCount: typeof factors.transitiveDependencyCount === "number" ? factors.transitiveDependencyCount : 0,
+        riskyTransitiveCount: typeof factors.riskyTransitiveCount === "number" ? factors.riskyTransitiveCount : 0
     };
 }
+function normalizeRiskTransitiveDependencies(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    return value
+        .map((entry) => {
+        if (!entry || typeof entry !== "object") {
+            return null;
+        }
+        const item = entry;
+        if (typeof item.name !== "string" ||
+            (item.trustScore !== "high" && item.trustScore !== "medium" && item.trustScore !== "low") ||
+            typeof item.confidence !== "number" ||
+            !Array.isArray(item.reasons) ||
+            !Array.isArray(item.introducedByPaths)) {
+            return null;
+        }
+        return {
+            name: item.name,
+            trustScore: item.trustScore,
+            confidence: normalizeConfidence(item.confidence),
+            reasons: item.reasons.filter((reason) => typeof reason === "string"),
+            introducedByPaths: item.introducedByPaths.filter((trace) => typeof trace === "string")
+        };
+    })
+        .filter((entry) => entry !== null);
+}
 function normalizeWorkspaceUsage(value) {
     if (!Array.isArray(value)) {
         return [];

package/dist/core/graph-builder.d.ts

@@ -11,5 +11,6 @@ export interface DependencyGraph {
     overrides: Record<string, unknown>;
     scripts: Record<string, string>;
     lockPackages: Record<string, LockPackageInstance[]>;
+    lockDependencies: Record<string, string[]>;
 }
 export declare function buildDependencyGraph(rootDir: string): Promise<DependencyGraph>;

package/dist/core/graph-builder.js

@@ -7,32 +7,29 @@ export async function buildDependencyGraph(rootDir) {
     const pnpmLockfilePath = path.join(rootDir, "pnpm-lock.yaml");
     const yarnLockfilePath = path.join(rootDir, "yarn.lock");
     const packageJson = await readJsonFile(packageJsonPath);
-    const lockPackages = new Map();
     try {
         const packageLock = await readJsonFile(lockfilePath);
-        for (const [packagePath, details] of Object.entries(packageLock.packages ?? {})) {
-            const name = extractPackageName(packagePath);
-            const version = details.version;
-            if (!name || !version) {
-                continue;
-            }
-            const instances = lockPackages.get(name) ?? new Map();
-            const normalizedPath = packagePath || "node_modules/" + name;
-            instances.set(normalizedPath, { path: normalizedPath, version });
-            lockPackages.set(name, instances);
-        }
-        for (const [name, details] of Object.entries(packageLock.dependencies ?? {})) {
-            if (!details.version) {
-                continue;
-            }
-            const instances = lockPackages.get(name) ?? new Map();
-            const normalizedPath = `node_modules/${name}`;
-            instances.set(normalizedPath, { path: normalizedPath, version: details.version });
-            lockPackages.set(name, instances);
-        }
+        const parsed = parseNpmLockfile(packageLock, {
+            ...packageJson.dependencies,
+            ...packageJson.devDependencies
+        });
+        return {
+            rootDir,
+            packageJsonPath,
+            lockfilePath,
+            dependencies: packageJson.dependencies ?? {},
+            devDependencies: packageJson.devDependencies ?? {},
+            overrides: packageJson.overrides ?? {},
+            scripts: packageJson.scripts ?? {},
+            lockPackages: parsed.lockPackages,
+            lockDependencies: parsed.lockDependencies
+        };
     }
     catch {
-        const fallbackLockfile = await readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath);
+        const fallbackLockfile = await readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath, {
+            ...packageJson.dependencies,
+            ...packageJson.devDependencies
+        });
         return {
             rootDir,
             packageJsonPath,
@@ -41,29 +38,19 @@ export async function buildDependencyGraph(rootDir) {
             devDependencies: packageJson.devDependencies ?? {},
             overrides: packageJson.overrides ?? {},
             scripts: packageJson.scripts ?? {},
-            lockPackages: fallbackLockfile.lockPackages
+            lockPackages: fallbackLockfile.lockPackages,
+            lockDependencies: fallbackLockfile.lockDependencies
         };
     }
-    return {
-        rootDir,
-        packageJsonPath,
-        lockfilePath,
-        dependencies: packageJson.dependencies ?? {},
-        devDependencies: packageJson.devDependencies ?? {},
-        overrides: packageJson.overrides ?? {},
-        scripts: packageJson.scripts ?? {},
-        lockPackages: Object.fromEntries(Array.from(lockPackages.entries()).map(([name, instances]) => [
-            name,
-            Array.from(instances.values()).sort((left, right) => left.path.localeCompare(right.path))
-        ]))
-    };
 }
-async function readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath) {
+async function readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath, rootDependencies) {
     try {
         const content = await fs.readFile(pnpmLockfilePath, "utf8");
+        const parsed = parsePnpmLockfile(content, rootDependencies);
         return {
             lockfilePath: pnpmLockfilePath,
-            lockPackages: parsePnpmLockfile(content)
+            lockPackages: parsed.lockPackages,
+            lockDependencies: parsed.lockDependencies
         };
     }
     catch {
@@ -71,58 +58,150 @@ async function readAlternativeLockfile(pnpmLockfilePath, yarnLockfilePath) {
     }
     try {
         const content = await fs.readFile(yarnLockfilePath, "utf8");
+        const parsed = parseYarnLockfile(content, rootDependencies);
         return {
             lockfilePath: yarnLockfilePath,
-            lockPackages: parseYarnLockfile(content)
+            lockPackages: parsed.lockPackages,
+            lockDependencies: parsed.lockDependencies
         };
     }
     catch {
         return {
-            lockPackages: {}
+            lockPackages: {},
+            lockDependencies: {}
         };
     }
 }
-function extractPackageName(packagePath) {
-    if (!packagePath) {
-        return null;
+function parseNpmLockfile(packageLock, rootDependencies) {
+    const lockPackages = new Map();
+    const lockDependencies = new Map();
+    for (const [packagePath, details] of Object.entries(packageLock.packages ?? {})) {
+        const name = details.name ?? extractPackageName(packagePath);
+        const version = details.version;
+        if (name && version) {
+            const instances = lockPackages.get(name) ?? new Map();
+            const normalizedPath = packagePath || "node_modules/" + name;
+            instances.set(normalizedPath, { path: normalizedPath, version });
+            lockPackages.set(name, instances);
+        }
+        if (name) {
+            addDependencyNames(lockDependencies, name, Object.keys(details.dependencies ?? {}));
+        }
     }
-    const match = packagePath.match(/(?:^|\/)node_modules\/(.+)$/);
-    if (!match) {
-        return null;
+    for (const [name, details] of Object.entries(packageLock.dependencies ?? {})) {
+        if (details.version) {
+            const instances = lockPackages.get(name) ?? new Map();
+            const normalizedPath = `node_modules/${name}`;
+            instances.set(normalizedPath, { path: normalizedPath, version: details.version });
+            lockPackages.set(name, instances);
+        }
+        addDependencyNames(lockDependencies, name, Object.keys(details.requires ?? {}));
     }
-    return match[1];
+    addDependencyNames(lockDependencies, "__root__", Object.keys(rootDependencies));
+    return {
+        lockPackages: toLockPackageRecord(lockPackages),
+        lockDependencies: toDependencyRecord(lockDependencies)
+    };
 }
-function parsePnpmLockfile(content) {
+function parsePnpmLockfile(content, rootDependencies) {
     const lockPackages = new Map();
-    for (const line of content.split(/\r?\n/)) {
-        const match = line.match(/^\s{2}(?:'|")?\/((?:@[^/]+\/)?[^/@'"]+)@([^('":]+)[^:]*:(?:'|")?\s*$/);
-        if (!match) {
+    const lockDependencies = new Map();
+    const lines = content.split(/\r?\n/);
+    let currentName = null;
+    let currentVersion = null;
+    let inDependenciesBlock = false;
+    for (const line of lines) {
+        const packageMatch = line.match(/^\s{2}(?:'|")?\/((?:@[^/]+\/)?[^/@'"]+)@([^('":]+)[^:]*:(?:'|")?\s*$/);
+        if (packageMatch) {
+            currentName = packageMatch[1];
+            currentVersion = packageMatch[2];
+            inDependenciesBlock = false;
+            addLockPackage(lockPackages, currentName, `pnpm:${currentName}@${currentVersion}`, currentVersion);
+            continue;
+        }
+        if (!currentName) {
+            continue;
+        }
+        if (/^\s{4}(?:dependencies|optionalDependencies):\s*$/.test(line)) {
+            inDependenciesBlock = true;
+            continue;
+        }
+        if (/^\s{4}\S/.test(line) && !/^\s{4}(?:dependencies|optionalDependencies):\s*$/.test(line)) {
+            inDependenciesBlock = false;
+        }
+        if (!inDependenciesBlock) {
             continue;
         }
-        addLockPackage(lockPackages, match[1], `pnpm-lock:${match[0].trim()}`, match[2]);
+        const dependencyMatch = line.match(/^\s{6}((?:@[^/]+\/)?[^:\s]+):\s*(.+)?$/);
+        if (!dependencyMatch) {
+            continue;
+        }
+        addDependencyNames(lockDependencies, currentName, [dependencyMatch[1]]);
     }
-    return toLockPackageRecord(lockPackages);
+    addDependencyNames(lockDependencies, "__root__", Object.keys(rootDependencies));
+    return {
+        lockPackages: toLockPackageRecord(lockPackages),
+        lockDependencies: toDependencyRecord(lockDependencies)
+    };
 }
-function parseYarnLockfile(content) {
+function parseYarnLockfile(content, rootDependencies) {
     const lockPackages = new Map();
+    const lockDependencies = new Map();
+    const lines = content.split(/\r?\n/);
     let currentNames = [];
-    for (const line of content.split(/\r?\n/)) {
+    let currentVersion = null;
+    let inDependenciesBlock = false;
+    for (const line of lines) {
         if (line.trim().length === 0 || line.startsWith("#")) {
             continue;
         }
         if (!line.startsWith(" ") && line.endsWith(":")) {
             currentNames = extractYarnEntryNames(line.slice(0, -1));
+            currentVersion = null;
+            inDependenciesBlock = false;
             continue;
         }
         const versionMatch = line.match(/^\s+version\s+"?([^"\s]+)"?\s*$/);
-        if (!versionMatch) {
+        if (versionMatch) {
+            currentVersion = versionMatch[1];
+            for (const name of currentNames) {
+                addLockPackage(lockPackages, name, `yarn:${name}@${currentVersion}`, currentVersion);
+            }
+            continue;
+        }
+        if (/^\s{2}dependencies:\s*$/.test(line)) {
+            inDependenciesBlock = true;
+            continue;
+        }
+        if (/^\s{2}\S/.test(line) && !/^\s{2}dependencies:\s*$/.test(line)) {
+            inDependenciesBlock = false;
+        }
+        if (!inDependenciesBlock) {
+            continue;
+        }
+        const dependencyMatch = line.match(/^\s{4}((?:@[^/]+\/)?[^"\s]+)\s+/);
+        if (!dependencyMatch) {
             continue;
         }
         for (const name of currentNames) {
-            addLockPackage(lockPackages, name, `yarn-lock:${name}@${versionMatch[1]}`, versionMatch[1]);
+            addDependencyNames(lockDependencies, name, [dependencyMatch[1]]);
         }
     }
-    return toLockPackageRecord(lockPackages);
+    addDependencyNames(lockDependencies, "__root__", Object.keys(rootDependencies));
+    return {
+        lockPackages: toLockPackageRecord(lockPackages),
+        lockDependencies: toDependencyRecord(lockDependencies)
+    };
+}
+function extractPackageName(packagePath) {
+    if (!packagePath) {
+        return null;
+    }
+    const match = packagePath.match(/(?:^|\/)node_modules\/(.+)$/);
+    if (!match) {
+        return null;
+    }
+    return match[1];
 }
 function extractYarnEntryNames(entry) {
     const names = new Set();
@@ -149,9 +228,25 @@ function addLockPackage(lockPackages, name, packagePath, version) {
     instances.set(packagePath, { path: packagePath, version });
     lockPackages.set(name, instances);
 }
+function addDependencyNames(lockDependencies, name, dependencies) {
+    if (dependencies.length === 0) {
+        return;
+    }
+    const entry = lockDependencies.get(name) ?? new Set();
+    for (const dependency of dependencies) {
+        entry.add(dependency);
+    }
+    lockDependencies.set(name, entry);
+}
 function toLockPackageRecord(lockPackages) {
     return Object.fromEntries(Array.from(lockPackages.entries()).map(([name, instances]) => [
         name,
         Array.from(instances.values()).sort((left, right) => left.path.localeCompare(right.path))
     ]));
 }
+function toDependencyRecord(lockDependencies) {
+    return Object.fromEntries(Array.from(lockDependencies.entries()).map(([name, dependencies]) => [
+        name,
+        Array.from(dependencies).sort((left, right) => left.localeCompare(right))
+    ]));
+}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { analyzeProject } from "./core/analyzer.js";
-export type { AnalysisOptions, AnalysisFocus, AnalysisResult, DepBrainBaseline, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, RiskFactors, ScoreBreakdown, RiskDependency, TopIssue, TrustScore, UnusedDependency, WorkspaceDependencyUsage, WorkspaceOwnershipSummary } from "./core/analyzer.js";
+export type { AnalysisOptions, AnalysisFocus, AnalysisResult, DepBrainBaseline, DuplicateDependency, OutdatedDependency, PolicyResult, PackageAnalysisResult, Recommendation, RiskFactors, RiskTransitiveDependency, ScoreBreakdown, RiskDependency, TopIssue, TrustScore, UnusedDependency, WorkspaceDependencyUsage, WorkspaceOwnershipSummary } from "./core/analyzer.js";
 export { OUTPUT_VERSION } from "./core/analyzer.js";
 export { PluginManager } from "./core/plugin-manager.js";
 export type { DepBrainPlugin, PluginDiagnostic, ProjectContext } from "./core/plugin-manager.js";

package/dist/reporters/console.js

@@ -31,8 +31,8 @@ export function renderConsoleReport(result) {
         ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
         : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
-        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("");
@@ -43,6 +43,13 @@ export function renderConsoleReport(result) {
     }
     return lines.join("\n");
 }
+function formatTransitiveRiskSuffix(item) {
+    if (item.riskyTransitiveDeps.length === 0) {
+        return "";
+    }
+    const names = item.riskyTransitiveDeps.slice(0, 3).map((entry) => entry.name).join(", ");
+    return ` [transitive score ${item.transitiveRiskScore}] [via ${names}]`;
+}
 function summaryLine(label, count) {
     const indicator = count === 0 ? "OK" : "WARN";
     return `${indicator} ${label}: ${count}`;

package/dist/reporters/dashboard.js

@@ -1,6 +1,11 @@
 export function renderDashboardReport(result) {
     const topIssues = result.topIssues.map(renderTopIssue).join("");
     const suggestions = result.suggestions.map((item) => `<li>${escapeHtml(item)}</li>`).join("");
+    const transitiveHotspots = result.risks
+        .filter((item) => item.riskyTransitiveDeps.length > 0)
+        .sort((left, right) => right.transitiveRiskScore - left.transitiveRiskScore)
+        .map(renderTransitiveHotspot)
+        .join("");
     return [
         "<!doctype html>",
         '<html lang="en">',
@@ -14,9 +19,11 @@ export function renderDashboardReport(result) {
         "header{display:flex;justify-content:space-between;gap:24px;align-items:flex-start;margin-bottom:24px}",
         "h1{font-size:28px;margin:0 0 8px}",
         "h2{font-size:18px;margin:0 0 12px}",
+        "h3{font-size:15px;margin:0 0 8px}",
         ".muted{color:#637083;font-size:13px}",
         ".score{font-size:48px;font-weight:700}",
         ".grid{display:grid;grid-template-columns:repeat(4,minmax(0,1fr));gap:12px;margin-bottom:20px}",
+        ".split{display:grid;grid-template-columns:1.2fr .8fr;gap:16px;margin-top:16px}",
         ".panel{background:#fff;border:1px solid #dce3ee;border-radius:8px;padding:16px}",
         ".metric{font-size:28px;font-weight:700;margin-top:4px}",
         ".pass{color:#167a43}.fail{color:#b42318}",
@@ -24,7 +31,9 @@ export function renderDashboardReport(result) {
         "li{margin:8px 0}",
         ".issue{margin-bottom:10px}",
         ".kind{font-size:12px;text-transform:uppercase;color:#637083}",
-        "@media(max-width:760px){main{padding:20px}.grid{grid-template-columns:repeat(2,minmax(0,1fr))}header{display:block}.score{font-size:40px}}",
+        ".hotspot{border-top:1px solid #e7ecf4;padding-top:12px;margin-top:12px}",
+        ".path{font-family:Consolas,monospace;font-size:12px;background:#f3f6fb;border-radius:6px;padding:6px 8px;margin:6px 0}",
+        "@media(max-width:760px){main{padding:20px}.grid{grid-template-columns:repeat(2,minmax(0,1fr))}.split{grid-template-columns:1fr}header{display:block}.score{font-size:40px}}",
         "</style>",
         "</head>",
         "<body>",
@@ -42,20 +51,36 @@ export function renderDashboardReport(result) {
         renderMetric("Outdated", result.outdated.length),
         renderMetric("Risks", result.risks.length),
         "</section>",
-        '<section class="panel">',
+        '<section class="split">',
+        '<div class="panel">',
         "<h2>Policy</h2>",
         `<p class="${result.policy.passed ? "pass" : "fail"}">${result.policy.passed ? "Passed" : "Failed"}</p>`,
         result.policy.reasons.length > 0
             ? `<ul>${result.policy.reasons.map((item) => `<li>${escapeHtml(item)}</li>`).join("")}</ul>`
             : '<p class="muted">No policy failures.</p>',
+        "</div>",
+        '<div class="panel">',
+        "<h2>Risk Snapshot</h2>",
+        `<div class="muted">${result.risks.filter((item) => item.riskyTransitiveDeps.length > 0).length} direct dependencies carry transitive risk.</div>`,
+        `<div class="metric">${result.risks.reduce((total, item) => total + item.transitiveRiskScore, 0)}</div>`,
+        '<div class="muted">Total transitive risk score</div>',
+        "</div>",
         "</section>",
-        '<section class="panel">',
+        '<section class="split">',
+        '<div class="panel">',
         "<h2>Top Issues</h2>",
         topIssues.length > 0 ? `<ol>${topIssues}</ol>` : '<p class="muted">No actionable issues found.</p>',
-        "</section>",
-        '<section class="panel">',
+        "</div>",
+        '<div class="panel">',
         "<h2>Suggestions</h2>",
         suggestions.length > 0 ? `<ul>${suggestions}</ul>` : '<p class="muted">No suggestions.</p>',
+        "</div>",
+        "</section>",
+        '<section class="panel">',
+        "<h2>Transitive Risk Hotspots</h2>",
+        transitiveHotspots.length > 0
+            ? transitiveHotspots
+            : '<p class="muted">No transitive risk hotspots found.</p>',
         "</section>",
         "</main>",
         "</body>",
@@ -74,6 +99,20 @@ function renderTopIssue(item) {
         "</li>"
     ].join("");
 }
+function renderTransitiveHotspot(item) {
+    return [
+        '<div class="hotspot">',
+        `<h3>${escapeHtml(item.name)} <span class="muted">score ${item.transitiveRiskScore}</span></h3>`,
+        `<div class="muted">${item.riskFactors.transitiveDependencyCount} transitive dependencies, ${item.riskyTransitiveDeps.length} risky transitive dependencies</div>`,
+        "<ul>",
+        item.riskyTransitiveDeps
+            .slice(0, 4)
+            .map((entry) => `<li><strong>${escapeHtml(entry.name)}</strong> [${escapeHtml(entry.trustScore.toUpperCase())}]<div>${escapeHtml(entry.reasons.join("; "))}</div>${entry.introducedByPaths.map((trace) => `<div class="path">${escapeHtml(trace)}</div>`).join("")}</li>`)
+            .join(""),
+        "</ul>",
+        "</div>"
+    ].join("");
+}
 function escapeHtml(value) {
     return value
         .replace(/&/g, "&amp;")

package/dist/reporters/markdown.js

@@ -35,8 +35,8 @@ export function renderMarkdownReport(result) {
         ? `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}] [${item.package}]`
         : `${item.name}: ${item.current} -> ${item.latest} [${item.updateType}]`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Risky dependencies", result.risks.map((item) => formatEntry(item.package
-        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]`
-        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]`, item.confidence, item.explanation, item.recommendation)));
+        ? `${item.name}: ${item.reasons.join("; ")} [${item.package}] [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`
+        : `${item.name}: ${item.reasons.join("; ")} [trust ${item.trustScore.toUpperCase()}]${formatTransitiveRiskSuffix(item)}`, item.confidence, item.explanation, item.recommendation)));
     appendSection(lines, "Policy reasons", result.policy.reasons);
     if (result.suggestions.length > 0) {
         lines.push("## Suggestions");
@@ -47,6 +47,13 @@ export function renderMarkdownReport(result) {
     }
     return lines.join("\n");
 }
+function formatTransitiveRiskSuffix(item) {
+    if (item.riskyTransitiveDeps.length === 0) {
+        return "";
+    }
+    const names = item.riskyTransitiveDeps.slice(0, 3).map((entry) => entry.name).join(", ");
+    return ` [transitive score ${item.transitiveRiskScore}] [via ${names}]`;
+}
 function appendSection(lines, title, items) {
     if (items.length === 0) {
         return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dep-brain",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "CLI and library for explainable dependency intelligence",
   "type": "module",
   "main": "dist/index.js",