audit-flutter-package

It checks dependencies by resolving them in an isolated temporary project using dart pub get, then executing dart pub deps --json to recursively map and verify all transitive dependencies for problematic entities.

The best way to evaluate a pub package's safety is to statically review the unpacked archive and reproduce dependency resolution in a sandboxed environment to identify supply-chain risks and generate an evidence-based audit report.

No, the Flutter package audit process prohibits running builds or tests, enforcing the use of safe commands like dart pub unpack --no-resolve, dart pub get, and dart pub deps --json for static verification and dependency resolution.

You need to verify transitive dependencies because packages resolved in a sandboxed environment may pull in problematic entities through the dependency tree, which static review of the top-level package archive alone cannot detect.

Yes, you can use this supply-chain audit approach for both new adoption and existing project updates by unpacking the target package archive and validating its resolved transitive dependency graph in an isolated temporary project.