niros_valtos

More specifically: 1. How do you know if the vulnerable package is called in a way that it can be exploited? For example, if the package has a critical vulnerability in a method "myFunc" but it is never called by your code, it won't be exploitable.

2. How do you know if it is safe to upgrade a package and it won't break changes? For example, if version 1.2.3 has "myFunc(p1,p2)" and it is called by your code, but the vulnerability was fixed in version 1.2.4, which has "myFunc(p1,p2,p3)".

3. What do you do if the vulnerable package is a sub-package of another package used by your code?