collect_runtime_closure asks deps.dev for the package's latest version and on 404 falls straight back to the repository dependency graph.
Observed on express-rate-limit/express-rate-limit, scanned 2026-08-04 — the same day 8.6.2 was published. deps.dev had not indexed it yet (it has since), so the scan warned "deps.dev does not index npm:express-rate-limit@8.6.2" and assessed the repo graph: 1292 resolved dependencies including the whole dev/test tree (mintlify etc.), the transitive and outstanding-advisory components excluded from scoring, and scary context numbers ("15 packages carry known advisories") for a package whose runtime closure is tiny and clean.
Any project scanned on release day hits this — and active projects are scanned near releases disproportionately often, since a release triggers interest. Suggested: on 404 for the latest version, retry with the previous published version (the registry version list is already in hand) before falling back to the repo graph. A one-version-old runtime closure is far closer to the truth than the full repo graph.
Context for the maintainer question about "56 existing vulnerabilities" in express-rate-limit/express-rate-limit#673: express-rate-limit/express-rate-limit#673 (comment)
collect_runtime_closureasks deps.dev for the package's latest version and on 404 falls straight back to the repository dependency graph.Observed on express-rate-limit/express-rate-limit, scanned 2026-08-04 — the same day 8.6.2 was published. deps.dev had not indexed it yet (it has since), so the scan warned "deps.dev does not index npm:express-rate-limit@8.6.2" and assessed the repo graph: 1292 resolved dependencies including the whole dev/test tree (mintlify etc.), the transitive and outstanding-advisory components excluded from scoring, and scary context numbers ("15 packages carry known advisories") for a package whose runtime closure is tiny and clean.
Any project scanned on release day hits this — and active projects are scanned near releases disproportionately often, since a release triggers interest. Suggested: on 404 for the latest version, retry with the previous published version (the registry version list is already in hand) before falling back to the repo graph. A one-version-old runtime closure is far closer to the truth than the full repo graph.
Context for the maintainer question about "56 existing vulnerabilities" in express-rate-limit/express-rate-limit#673: express-rate-limit/express-rate-limit#673 (comment)