Hidden Amplifiers: Cross-Level Risk in Software Supply Chains

Modern software supply chains comprise hundreds of transitive dependencies, yet existing analysis tools operate at either the ecosystem level dependency graphs or the code level static analysis within packages. This separation creates two failure modes. First, false-positive CVE alerts for...