The vulnerability three packages deep.

Modern apps are 80-90% third-party code. SCA checks every dependency against known-CVE databases — and the real danger usually isn't the library you chose, it's the one it silently pulled in.

One direct dependency, two levels of surprise

express@4.18.0direct — you chose this

body-parser@1.19.0transitive — express chose this

qs@6.5.2known CVE

dependency tree

# Node.js — full tree, including transitive deps
npm ls --all

# Python equivalent
pipdeptree

Why it matters

A real app can have 20 direct dependencies and thousands of transitive ones — a serious CVE can sit several levels deep, in a package nobody on the team has ever heard of.

Manual dependency review doesn't scale past this depth — automated SCA tooling isn't a nice-to-have, it's the only way this risk is visible at all.