Exposure is transitive
Almost nothing you ship depends on the compromised package directly. The risk lives three and four hops down, in packages no engineer on your team has ever read.
Graph traversal on HydraDB
See the full blast radius.
One compromised npm package reaches further than any lockfile shows. BlastRadius traverses the complete transitive graph in real time — every package, service, maintainer and CI/CD path it can touch.
REGISTRIESnpm · PyPI
PACKAGES INDEXED10,000
EDGE TYPES5
MEDIAN TRAVERSE312ms
THE PROBLEM
One stolen npm token reaches thousands of services you don't operate.
Persistence outlives detection
Malicious installs write into .git/hooks, .vscode/tasks.json and agent configs. Removing the version does not remove the foothold.
Ecosystems are not isolated
The same maintainer identity often publishes to npm and PyPI on the same credentials. Scanning one registry measures half the exposure.
PLATFORM
Six analyses on one graph.
Every capability reads the same dependency graph, so a finding in one view resolves to the same nodes in every other.
Blast radius query
Full transitive closure from any package or version, returning affected packages, exposed services and the shortest path to each.
Typosquat detection
Edit-distance and keyboard-adjacency scoring against the popular-package set. 91.0% F1 across a 45-case labelled benchmark.
Maintainer risk scoring
Publish cadence, account age, package concentration and shared infrastructure, scored 0–100 per maintainer.
Cross-ecosystem correlation
Matches npm maintainers to PyPI identities by email and GitHub handle, then multiplies the radius across both registries.
CI/CD persistence tracking
Models config-file infection as first-class graph edges and estimates how long a foothold survives after the package is pulled.
Compromise simulation
Assume any package is owned tomorrow and read the resulting exposure before it happens. Useful for pinning and vendor review.
GRAPH MODEL
Dependencies are one edge type out of five.
A dependency tree explains how code arrives. It does not explain how an attacker moves. BlastRadius stores the movement itself as typed edges, so traversal follows tokens, organisations and infected configs the same way it follows a manifest.
- depends_on
- Declared and transitive manifest edges
- installs_persistence
- Config-file footholds in developer environments
- propagates_via
- Modelled attack vectors between nodes
- shared-npm-token
- Publish credentials common to several packages
- shared-github-org
- Organisation-level blast paths and scopes
traversal · queryForcefulRelations depth 4 · maxResults 50
event-stream@3.3.6 d0 · compromised└─ flatmap-stream@0.1.1 d1 · depends_on
└─ @internal/ui-kit@4.2.0 d2 · depends_on
├─ checkout-web@1.8.3 d3 · service
└─ payments-api@2.0.1 d3 · service
└─ .git/hooks/pre-commit d1 · installs_persistence
└─ npm:dominic-tarr d1 · shared-npm-token
··· 14 additional paths
VALIDATION
Measured against incidents that already happened.
TYPOSQUAT DETECTION F191.0%
MEDIAN FULL-GRAPH TRAVERSAL312ms
PERSISTENCE MULTIPLIER2.73×
DOCUMENTED INCIDENT RECALL100%
ARCHITECTURE
From registry to radius in four stages.
Collect
Continuous registry sync pulls package metadata, versions, maintainer data and historical publish patterns.
Construct
Full dependency resolution builds the dependency graph with typed edges for manifests, tokens, and persistence vectors.
Traverse
Graph queries follow typed edges to compute blast radius, shortest paths, and exposure surfaces in real time.
Score
Risk scoring combines CVSS data, maintainer health signals, and transitive depth to prioritize findings.
See your blast radius.
Start with a single package query. No installation required.