Incoprea Research · Hypothesis tests IIIWorking results · not peer reviewed

Test 05 · Software

Dependency Depth Predicts Vulnerability

A package's vulnerability rate is predicted by its dependency depth better than by its own code size.

Not supported
Volume XXIX · Theory 58 · New analysis

What the test shows

Across 50 popular npm packages, vulnerability count tracks weekly downloads (popularity) far more than dependency structure: Spearman ρ = 0.43 for downloads, 0.27 for log code size, 0.11 for transitive breadth, and 0.05 for max depth. Controlling size and downloads, depth adds little (partial ρ = 0.155, p = 0.28), and code size predicts more strongly than depth (partial ρ = 0.278, p = 0.05). The claim's contrast — depth over code size — does not hold.

Popularity, not dependency depth, predicts vulnerabilitiesdependency depth: 0.0491206318872996550.05dependencydepthtransitive breadth: 0.107185774709353480.11transitivebreadthown code size (log): 0.27030883350549220.27own codesize (log)weekly downloads (log): 0.427976437227080060.43weeklydownloads (log)Spearman rho with vulnerability countn = 50 packages. Depth is capped at 5. Popularity (downloads) is the confounder.
Limits. Depth is capped at five, the sample is fifty packages selected for popularity, and vulnerability counts reflect reporting intensity, which is confounded with downloads. A larger or more representative sample could differ.

Takeaway

Not supported. Popularity, not dependency depth, predicts vulnerability counts, and code size is the stronger of the two structural predictors.

← All testsDependency Depth Predicts Vulnerability

Working results, 30 October 2026. Not peer reviewed. Not medical, investment or policy advice. Testing and analysis by DeepSeek (AI); organisation by Codex. Every number regenerates from the included result files.