**_We Raised $20 Million_** _/_ [_Read the Announcement_](https://raven.io/blog/%20raven-raises-20m-seed-round-to-protect-applications-at-runtime-even-without-signatures-or-cves)

# Transitive Dependencies

Transitive dependencies are indirect dependencies in software applications or projects. Specifically, they refer to libraries or modules that your code doesn’t directly import or use but are instead required by the libraries or modules you do use directly. These hidden dependencies significantly impact your software's security and stability, as vulnerabilities within them can quietly affect your entire system.

Managing transitive dependencies is challenging due to their complexity and obscurity. They can create intricate dependency trees, complicating maintenance and increasing risks like version conflicts and security vulnerabilities. Raven’s dependency path and detailed Software Bill of Materials (SBOM), provide the essential tools to effectively mitigate these risks and ensure application reliability and security.

## Accelerate Fixes with Full Visibility

### Expedite Remediation

Raven visualizes complete dependency paths, enabling developers to quickly identify and remediate vulnerabilities.

### Expose Hidden Risks

Raven maps full dependency paths, revealing vulnerabilities buried deep in transitive dependencies that traditional tools often miss.

### Simplify Complexity

Raven untangles complex dependency trees, making it easier to manage, assess, and secure your entire stack.

## Check out more Use Cases

Eliminate the Exposure Window
[Learn More](https://raven.io/use-cases/transitive-dependencies#)

CVSS 10 With No Risk
[Learn More](https://raven.io/use-cases/cvss-10-with-no-risk)

Stop Application Attacks
[Learn More](https://raven.io/use-cases/stop-attack)

## Reduce your CVE noise by 99% today!

## Blog

### Security

The malicious Axios releases weren't a smash-and-grab. They were a multi-stage malware campaign using npm's install path as a deployment mechanism. Here's what that means for defenders.
[_Read more_](https://raven.io/blog/axios-wasnt-just-compromised-it-was-weaponized)

### Company News

Raven secures $20M to stop application exploits at runtime—even without CVEs or signatures—bringing real-time protection inside the application layer.
[_Read more_](https://raven.io/blog/raven-raises-20m-seed-round-to-protect-applications-at-runtime-even-without-signatures-or-cves)

### Security

A deep analysis of React2Shell (CVE-2025-55182) RCE in RSC Flight protocol—and why WAF rule patches fail to protect modern React and Next.js apps.
[_Read more_](https://raven.io/blog/the-deepest-research-on-the-react2shell-cve-2025-55182-and-why-your-waf-rule-patch-leaves-you-exposed)