About this episode

Andrew Nesbitt discusses the risks of transitive dependencies and the impact of AI on open source security.

At UN Open Source Week in New York, Richard hosts a short, on-the-fly Sustain mini-episode from IBM’s offices with Andrew Nesbitt of Ecosyste.ms, a registry-of-registries built from dependency data across 300 million repositories. Nesbitt explains how that data is being used to prioritize security scanning with new AI models, revealing that many heavily used but dormant transitive dependencies—often unseen and unaudited—are high risk; in his testing of about 3,000 critical, abandoned projects across multiple ecosystems, roughly 50% had serious vulnerabilities, including logic flaws that can chain across dependency trees. He warns that LLMs accelerate both discovery and exploitation, shrinking traditional 90-day disclosure windows to effectively zero. They urge developers to prune and update dependencies and devices promptly, and to support maintainers respectfully—financially or with broader help—amid vulnerability floods and initiatives like the “Summer of Bliss.” 00:00 UN Open Source Week 00:58 Meet Andrew Nesbitt 01:45 AI Models Meet Dependency Data 04:05 The Hidden Transitive Risk 07:02 Abandoned Packages Crisis 08:34 Why It Matters Now 09:44 Responsible Disclosure Shrinks…

Explore listener stats, chart rankings, contacts and more on the Sustain podcast page.