What problem does it solve? Modern projects depend on dozens of third-party packages, and any one of them can become an attack vector through maintainer compromise, abandonment, or unpatched vulnerabilities. Manually vetting every dependency's maintenance health, popularity, and security posture is slow and error-prone. ## Core Features & Use Cases - Risk Factor Evaluation: Scores each dependency against six criteria including single-maintainer status, staleness, low popularity, high-risk features like FFI or deserialization, past CVEs, and missing security contacts. - GitHub Data Verification: Uses the gh CLI to pull accurate star counts, open issue counts, and repository metadata rather than guessing. - Structured Reporting: Produces a results.md report with a high-risk dependency table, risk factor counts, suggested alternatives, and an executive summary. - Use Case: Before a security engagement, run the audit on a client's repository to identify that an unmaintained, single-maintainer parsing library is a takeover risk, and receive a vetted drop-in replacement recommendation. ## Quick Start Audit this project's dependencies for supply chain risk and generate a report of high-risk packages with suggested alternatives.
