Why a package you never installed can trigger a high-severity vulnerability alert

When a security scan flags a vulnerable package that does not appear in your project's manifest, it is likely a transitive dependency — one pulled in indirectly by a package you did explicitly install. A typical modern JavaScript project may have only a handful of direct dependencies but hundreds of transitive ones, making this a widespread and often overlooked risk. Fixing a vulnerable transitive dependency requires identifying which direct dependency pulls it in and upgrading that, rather than installing the vulnerable package directly. Package managers also 'hoist' dependencies within the file system, meaning a package's physical location in node_modules does not reliably indicate how many levels deep it sits in the actual dependency graph. Tools that trace the full dependency graph back to the root — using lockfiles from npm, Yarn, Maven, or similar systems — can pinpoint the exact upgrade or version override needed to resolve the issue.