[Verse 1]
Start with your service at the root of the tree
Map every package that it needs to be free
Direct dependencies are just level one
But the real story has only begun
Each package pulls in its own demands
Creating branches that spread through the lands
[Chorus]
Count the connections, trace every line
Transitive packages intertwine
The deeper they reach, the more they appear
Dependencies of dependencies here
Map it, count it, rank them all
Find the ten that touch it all
[Verse 2]
Your web framework needs a JSON parser too
That parser needs utilities to see it through
Those utilities need crypto and string manipulation
Each level adds more complication
One direct import becomes fifty indirect
Supply chain risks you didn't expect
[Chorus]
Count the connections, trace every line
Transitive packages intertwine
The deeper they reach, the more they appear
Dependencies of dependencies here
Map it, count it, rank them all
Find the ten that touch it all
[Bridge]
Build your tree from top to bottom
Every branch and leaf, you've got them
Calculate the reference count
Which packages have the highest amount
Lodash, moment, axios too
Core utils that flow right through
[Verse 3]
Most transitive means most widely used
Across your tree they are diffused
These critical packages pose the greatest threat
If compromised, the whole stack's upset
Security updates matter most
For packages that are your host
[Chorus]
Count the connections, trace every line
Transitive packages intertwine
The deeper they reach, the more they appear
Dependencies of dependencies here
Map it, count it, rank them all
Find the ten that touch it all
[Outro]
Know your tree from root to leaf
Transitive deps bring hidden grief
Map them well and sleep with ease
Your supply chain dependencies