Paste a package name
Enter any npm or PyPI package. Meridian identifies the ecosystem automatically and fetches the dependency graph from HydraDB.
Six tiles light up
Each tile answers one security question in parallel: exposed services, compromised lockfiles, typosquat neighbours, maintainer clusters, and more.
Copy the fix
The verdict at the top of the page is one English sentence and one shell command. Read it, paste it, done.
The six tiles
Each tile answers one security question. All six run in parallel when you scan a package.
Which internal services transitively depend on this version?
Which version of the dependency introduced the vulnerability?
Which applications resolved the bad version while it was live?
Which other packages share a maintainer or infrastructure?
Are there edit-distance neighbours registered nearby?
What is the complete blast radius across services + lockfiles?
Under the hood
For developers: Meridian runs six deterministic Cypher queries against HydraDB. The queries are in src/lib/cypher.ts.
Why a graph database?
Supply chain exposure is a transitive dependency problem. Vector search finds similar packages; graph traversal finds every service that transitively resolves a specific version. The headline query is a 6-hop reverse traversal.
Why no LLM?
The six queries are reproducible. Same input, same output, byte for byte. There is no model in the answer path.
Run it locally
Clone the repo, run pnpm i && pnpm dev to boot against a 5K-node fixture. Add a real graph with docker compose up -d hydradb.