MATCH (npm:lodash@*)<-[:DEPENDS_ON*1..6]-(svc:Service)
| service | team | env | hops |
|---|---|---|---|
| checkout-svc | platform | prod | 1 |
| worker-queue | checkout | stage | 2 |
| edge-router | growth | prod | 3 |
| auth-api-gw | billing | prod | 4 |
| billing-svc | edge | prod | 1 |
| search-svc | platform | prod | 2 |
| audit-logger | checkout | stage | 3 |
| metrics-collector | growth | prod | 4 |
MATCH (advisory)-[:AFFECTS]->(version) — published timeline
| version | published | repo | live_during_compromise |
|---|---|---|---|
| 3.10.7 | 2026-07-12 | github.com/TanStack/virtual | false |
| 3.10.8 | 2026-08-14 | github.com/TanStack/virtual | true |
| 3.10.9 | 2026-08-15 | github.com/TanStack/virtual | false |
MATCH (Version)<-[:RESOLVES]-(Lockfile)<-[:USES_LOCKFILE]-(Service)
| lockfile | service | team | captured | window |
|---|---|---|---|---|
| apps/web/package-lock.json | checkout-svc | platform | 2026-08-11T00:00Z | 4h 12m |
| services/checkout/package-lock.json | worker-queue | checkout | 2026-08-12T01:00Z | 4h 12m |
MATCH (Maintainer)-[:MAINTAINS]->(sibling) — same-CI clusters collapse
| package | ecosystem | monthly_downloads | same_ci |
|---|---|---|---|
| sibling-a | npm | 240000 | true |
| sibling-b | pypi | 223000 | false |
MATCH (Package)<-[:TYPOSQUAT_OF { distance: 1..2 }]-(candidate)
| candidate | edit_distance | first_seen | installs |
|---|---|---|---|
| typo-1 | 1 | 2026-08-10T00:00Z | 1280 |
| typo-2 | 2 | 2026-08-11T01:00Z | 1170 |
AGG services ⊕ lockfiles ⊕ typosquats — 3 optional MATCH arms in one query
| services_count | lockfiles_count | typosquats_count |
|---|---|---|
| 8 | 2 | 2 |
lodash@1.0.0 published clean
+dependency.added chalk-extra 0.0.1
lodash@1.0.0 rebuilt with payload
typosquat install spike 240× chalk-extras
co-maintainer vit-dev-bot 12 ops/min
2 lockfiles × 8 services resolved the bad version
breach window 4h 12m push guard ⚑