The vulnerability three packages deep

Introduces SCA and explains why transitive dependencies — not the libraries you directly chose — are the real risk.