Episode 290: Andrew Nesbitt on AI, Transitive Dependencies, and the New Open Source Security Crunch

At UN Open Source Week in New York, Richard hosts a short, on-the-fly Sustain mini-episode from IBM’s offices with Andrew Nesbitt of Ecosyste.ms, a registry-of-registries built from dependency data across 300 million repositories. Nesbitt explains how that data is being used to prioritize security scanning with new AI models, revealing that many heavily used but dormant transitive dependencies—often unseen and unaudited—are high risk; in his testing of about 3,000 critical, abandoned projects across multiple ecosystems, roughly 50% had serious vulnerabilities, including logic flaws that can chain across dependency trees. He warns that LLMs accelerate both discovery and exploitation, shrinking traditional 90-day disclosure windows to effectively zero. They urge developers to prune and update dependencies and devices promptly, and to support maintainers respectfully—financially or with broader help—amid vulnerability floods and initiatives like the “Summer of Bliss.” 00:00 UN Open Source Week 00:58 Meet Andrew Nesbitt 01:45 AI Models Meet Dependency Data 04:05 The Hidden Transitive Risk 07:02 Abandoned Packages Crisis 08:34 Why It Matters Now 09:44 Responsible Disclosure Shrinks 11:48 What You Can Do Today 13:10 Support Maintainers Better 15:30 Wrap Up and Call to ActionSpecial Guest: Andrew Nesbitt.