Result
Enter a package above and compute its blast radius.
Or start with one of these:
The blast radius is
computed over packages, not versions — it answers "what's exposed" and "who shares
publish rights". Version-level advisory ranges are answered separately, below. Not
answered: "who resolved the bad version while it was live", which needs lockfile
history this graph does not model. See the README's Status table.
Traced path
Click any node in the graph to trace the exact
chain that exposes it.
Shared publish rights
Compute a blast radius to see which packages share
a maintainer with it.
Versions & advisories
Compute a blast radius to see which published
versions sit inside a known advisory's affected range.
Legend
target (compromised package)
dependency distance
1 hop → 4+ hops from the target
1 hop → 4+ hops from the target
maintainer (square = different vertex type)
reachable only via publish rights
in the dependency tree and in credential range
Typosquat scan
Loading...