Andrew Nesbitt on AI, Transitive Dependencies, and the New Open Source Security Crunch

At UN Open Source Week in New York, Richard hosts a short, on-the-fly Sustain mini-episode from IBM’s offices with Andrew Nesbitt of Ecosyste.ms, a registry-of-registries built from dependency data across 300 million repositories. Nesbitt explains how that data is being used to prioritize security scanning with new AI models, revealing that many heavily used but dormant transitive dependencies—often unseen and unaudited—are high risk; in his testing of about 3,000 critical, abandoned projects across multiple ecosystems, roughly 50% had serious vulnerabilities, including logic flaws that can chain across dependency trees. He warns that LLMs accelerate both discovery and exploitation, shrinking traditional 90-day disclosure windows to effectively zero. They urge developers to prune and update dependencies and devices promptly, and to support maintainers respectfully—financially or with broader help—amid vulnerability floods and initiatives like the “Summer of Bliss.”

00:00 UN Open Source Week
00:58 Meet Andrew Nesbitt
01:45 AI Models Meet Dependency Data
04:05 The Hidden Transitive Risk
07:02 Abandoned Packages Crisis
08:34 Why It Matters Now
09:44 Responsible Disclosure Shrinks
11:48 What You Can Do Today
13:10 Support Maintainers Better
15:30 Wrap Up and Call to Action