Theory 58/New analysis/Software
Dependency Depth Predicts Vulnerability
The claim
A package's vulnerability rate is predicted by its dependency depth better than by its own code size.
01Mechanism
Vulnerabilities arrive through dependencies; depth determines exposure surface.
02Prediction
Vulnerability should track depth.
03Refutation
Vulnerability tracking own size would remove dependencies.