Modern JavaScript and TypeScript applications routinely pull in thousands of transitive dependencies. Standard Software Composition Analysis (SCA) scanners generate flat, decontextualized alert avalanches that fail to indicate whether vulnerable code is actually imported or reached. This causes severe alert fatigue and leads teams into breaking, blind upgrades.

Unified three distinct layers into a single property graph: package manifest dependencies (DEPENDS_ON), source code imports and entry point paths (IMPORTS, REACHES), and OSV security advisories (AFFECTS). Implemented four mutually exclusive evidence tiers (confirmed_entry_path, imported_only, transitive_dependency_only, no_path_found) evaluated via Cypher graph queries to compute deterministic risk scores.

Engineered an asynchronous FastAPI (Python 3.11+) backend communicating with FalkorDB over the low-latency Redis protocol. Integrated the live OSV.dev batch REST API with offline fixture fallback, an AST/regex static import scanner, and a dependency-free SemVer 2.0.0 evaluator for calculating upgrade compatibility costs (patch, minor, major). Built a dark-mode security operations console in React 19, TypeScript, and Vite 6 backed by a 168-test automated pytest suite.

Local npm Project → AST Import Scanner & Lockfile Parser → OSV.dev Advisory Ingestion → FalkorDB Graph (RedisGraph Protocol) → Cypher Reachability Traversal → Deterministic Risk Engine → SemVer Remediation Planner & Unified Diff Proposal → React 19 Security Operations Console.