Skip to content

Estate
Faults
Applications
Maintainers
Trace

⌘K

ProbingChecking the database connection

Estate
Faults
Applications
Maintainers
Trace

Drawing the sheet

Loading

Chokepoints

A maintainer who is the only person able to publish a package, on an account with no second factor, is a live risk to everything downstream of it. No vulnerability feed will ever tell you about this: there is no advisory, no CVSS score and nothing to upgrade to. There is only the shape of the graph.

This is the query a relational schema handles worst: a recursive closure over the dependency table, joined against a GROUP BY … HAVING COUNT(*) = 1 over maintainers, collapsed again by a distinct count. Here it is one traversal and a four-line predicate.

Sole owners without 2FA

12 accounts

Ines Oduyaines-oduya · Northgate Foundation2 packagespygments, undiciApplications above12 Ekene Okonkwookonkwo-e · Unaffiliated3 packageshas-flag, ms, util-deprecateApplications above9 Jun Nakamuraj-nakamura · Unaffiliated3 packagesbalanced-match, brace-expansion, concat-mapApplications above9 Margaux Delacroixdelacroix · Unaffiliated3 packagesansi-regex, ansi-styles, strip-ansiApplications above9 Mateo Adeyemimateo-adeyemi · Northgate Foundation3 packagesescape-html, on-finished, tr46Applications above9 Svetlana Popovasvetla-p · Unaffiliated3 packagesinherits, safe-buffer, string_decoderApplications above9 Tom Quillerquiller · Unaffiliated3 packagescolor-name, emoji-regex, is-fullwidth-code-pointApplications above9 Karim Vasquezkarim-vasquez · Unaffiliated2 packagescontent-type, p-limitApplications above9 Marta Bergmanmarta-bergman · Quarry Collective2 packagesgraceful-fs, mapbox-glApplications above9 Emeka Ivanovaemeka-ivanova · Unaffiliated1 packagefast-globApplications above9 Farid Eriksenfarid-eriksen · Unaffiliated1 packagexml2jsApplications above9 Nkechi Abarankechi-abara · Unaffiliated1 packagepicomatchApplications above9

Packages are listed by the maintainer who solely owns them; follow a name to see every application that sits above their work and by what route. Package links: pygments undici has-flag ms util-deprecate balanced-match brace-expansion concat-map

Record

Understory · dependency reach

Sheet

6 of 6 · Chokepoints

Traversal bound

8 hops

Instance

bolt+s://db-729ceaca.bravo.databases.cognodb.com

Synthetic dataPackage names and ecosystems are real. The organisation, its applications, its maintainer accounts and every advisory in this graph are invented for the demonstration. No advisory here describes a real published vulnerability.