Transitive Dependencies: The Silent Risk That Accounts for 70% of Open Source Vulnerabilities

The Transitive Dependency Problem in Numbers

Research from the open source security community consistently shows that between 60% and 80% of vulnerabilities found in real applications are in transitive dependencies rather than direct ones. This makes intuitive sense: most experienced developers have some awareness of the major direct dependencies they choose, and might read release notes or security advisories for those packages. Transitive dependencies accumulate without deliberate review, and new transitive packages can be added by an upstream maintainer without any action by the downstream team.

How Transitive Vulnerabilities Enter Your Stack

There are three common pathways. First, you add a library that already contains a vulnerable transitive dependency — the vulnerability exists from day one, but you are unaware of it. Second, a maintainer of one of your transitive dependencies releases a new version that introduces a new dependency (or updates an existing one to a vulnerable version) — your pinned direct dependency now pulls in a newly-vulnerable transitive package. Third, a new CVE is published against a package that was already in your transitive graph — your stack becomes vulnerable without any change to your code or dependencies.

Depth of Analysis: Where Tools Differ

Not all SCA tools analyze the full transitive dependency graph. Some tools — particularly simpler, cheaper options — only scan one or two levels deep, or only analyze direct dependencies listed in package manifests. This significantly underrepresents your actual vulnerability exposure. When evaluating SCA tools, specifically test whether they capture the complete transitive graph by comparing their output against a manual npm ls --all or mvn dependency:tree for a known project.

The Remediation Challenge

Fixing a transitive vulnerability is more complex than fixing a direct one. The remediation path is: identify which of your direct dependencies brings in the vulnerable transitive package; determine if a newer version of that direct dependency uses a patched version of the transitive package; update the direct dependency if possible; verify that the update does not break your application. This chain can be long and sometimes impossible if upstream maintainers have not yet released a fix. SCA tools that provide remediation guidance — showing the exact upgrade path for transitive fixes — are significantly more valuable than those that only report the vulnerability.