BlastRadius computes the complete transitive dependency closure of any npm package in seconds. Powered by HydraDB's graph-native engine — the question a vector database cannot answer.
In 2016, the unpublishing of left-pad broke thousands of projects. In 2024, a compromised ultra package ran malicious code on every install.
The question is always the same: what else is affected? Not just direct dependents — the entire transitive closure. That's a graph traversal problem, and it's what BlastRadius solves.
Every package affected, directly or indirectly, up to 10 hops. Computed via HydraDB's native OpenCypher path procedure — a graph traversal, not a search.
Every package they maintain is at risk. Traced through the maintainer graph: package → MAINTAINED_BY → maintainer ← MAINTAINED_BY ← other packages.
Potential typosquat attacks, ranked by Levenshtein edit distance. Catches left_pad, leftpad, lodas — the packages that trick developers into installing malware.
HydraDB's native path procedure algo.SSpaths traverses incoming DEPENDS_ON edges from the compromised package, finding every dependent in a single query. Each path returned contains the full chain of nodes and relationships.
Try es-errors, chalk, or debug to see the full blast radius in seconds.