{"id":41231,"date":"2021-06-04T02:59:13","date_gmt":"2021-06-04T02:59:13","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/how-to-use-googles-new-dependency-mapping-tool-to-find-security-flaws-buried-in-your-projects\/"},"modified":"2021-06-04T02:59:13","modified_gmt":"2021-06-04T02:59:13","slug":"how-to-use-googles-new-dependency-mapping-tool-to-find-security-flaws-buried-in-your-projects","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-to-use-googles-new-dependency-mapping-tool-to-find-security-flaws-buried-in-your-projects\/","title":{"rendered":"How to use Google’s new dependency mapping tool to find security flaws buried in your projects"},"content":{"rendered":"

Google has built an online tool that maps out all the dependencies in millions of open-source software libraries and flags up any unpatched vulnerabilities.<\/p>\n

This is useful for finding out what exactly is inside the libraries used by your programming projects, and crucially, whether they contain hidden security bugs that haven’t been fixed. Thus, you can choose another set of packages, or help get the holes patched, to avoid leaving your application exploitable.<\/p>\n

These days, when you pull a library into a project, you’re typically pulling in dozens of dependencies and sub-dependencies of that library. And any of these components could \u2013 and do<\/a> \u2013 contain security holes, which may leave the parent program vulnerable to attack.<\/p>\n