Loading page
About this tool
Model how a handful of direct dependencies expands into hundreds of transitive packages, and what that does to your attack surface.
This tool models how a handful of direct dependencies expands into the full installed dependency graph, using a branching-tree model (direct deps x branching factor per level, collapsed for package reuse) plus a Poisson model for security-advisory arrivals. It is built for developers and security engineers who want to explain — to themselves or to a team — why a 25-package manifest turns into hundreds of installed packages, what that does to attack surface, and which supply-chain controls that size of graph actually justifies.
Open Transitive Dependency Risk Explainer on AltFTool — it loads instantly in your browser.
Add your input to the workspace.
Adjust the options until the result looks right.
Copy or download the output and put it to work.
Shows reachable versus newly installed packages at every depth, so you can see exactly where the graph explodes.
Applies a Poisson model to your advisory rate to give expected advisories per year and the chance of at least one.
Recommends only the supply-chain controls (lockfiles, script blocking, registry pinning, provenance) that your graph size warrants.
A transitive dependency is a package you never declared yourself — it is installed because something you did declare depends on it, directly or through further layers. In most ecosystems transitive packages outnumber direct ones many times over; this tool models that expansion as direct deps multiplied by an average branching factor at each level, minus the share already installed.
Because every installed package is code that runs with your application's privileges, yet you only reviewed the packages you chose directly. A graph of 500 packages with an advisory rate of 0.05 per package per year should expect around 25 advisories annually, and in npm-style ecosystems some of those packages can also run arbitrary install scripts on your machine or CI runner.
Run your ecosystem's graph command: npm ls --all (or count entries in package-lock.json), pip list or pipdeptree for Python, go mod graph for Go, mvn dependency:tree for Maven, or cargo tree for Rust. This tool's presets are typical orders of magnitude, not measurements — feed the real numbers back in to score your actual project.
Removing a single direct dependency removes its entire subtree, which is the highest-leverage move — pruning one package with an expansion factor of 10 removes roughly ten installed packages. After that, the baseline controls are committing your lockfile, enabling automated advisory alerts, and disabling install scripts in CI; treat this tool as informational modelling, not a substitute for a real dependency scan.