Explore Dependency Risks
Search for a package to map its blast radius and interactive dependencies.
—
Interactive Graph
Drag nodes to explore structural relationships
Maintainers
Known Vulnerabilities
Depends On 0
Depended On By 0
Transitive Vulnerability Impact
Multi-hop structural damage traversal
Shared-Maintainer Risk
Lateral structural exposure through identical maintainers
Ecosystem Risk Board
Structural risk signals computed directly via graph traversal.
Critical Bus Factor
Packages with a single maintainer
Maintainer Monopolies
Entities controlling 3 or more packages
Circular Dependencies
Infinite resolution loops (A → B → C → A)
Path Finder
Calculate the shortest dependency vector between any two nodes.
About DepGraph
DepGraph is a diagnostic web application designed to explore a fictional open-source package ecosystem (similar to npm). It exposes the hidden structural risks within dependency chains—providing the exact multi-hop insights that security and platform engineers need.
Project Context
This demo application was built specifically for the Wexa AI take-home assessment. It relies on custom seed data (28 fictional packages, 10 maintainers, 3 CVEs, and 1 deliberate circular dependency) loaded into a CognoDB instance to demonstrate real-world vulnerability tracing.
Core Features & Screens
Package Explorer: Search or click any package to view its description, version, maintainers, known vulnerabilities (CVEs), and what it directly depends on. Includes an interactive visual neighborhood graph.
Vulnerability Blast-Radius: Traces the multi-hop fallout of a compromised low-level library (e.g., safe-buffer → http-lean → webforge). This answers the critical question: "Am I secretly exposed to this bug?"
Maintainer Risk Board: Identifies single points of failure by flagging packages with a "bus factor" of one, and highlights individual maintainers who single-handedly control a concentration of risk.
Circular Dependency Detector: Automatically detects notorious build-breaking loops where package A depends on B, which depends on C, which accidentally depends back on A.
Path Finder: Calculates the shortest dependency vector between any two arbitrary packages.
The Data Engine
Ultimately, this tool answers: "If something goes wrong with one small piece, how far does the damage spread?" It utilizes a graph database because mapping dependencies-of-dependencies is exactly what graph architectures are built to do, far outperforming traditional relational databases for multi-hop queries.