Episode 290: Andrew Nesbitt on AI, Transitive Dependencies, and the New Open Source Security Crunch

At UN Open Source Week in New York, Richard hosts a short, on-the-fly Sustain mini-episode from IBM’s offices with Andrew Nesbitt of Ecosyste.ms, a registry-of-registries built from dependency data across 300 million repositories. Nesbitt explains how that data is being used to prioritize security scanning with new AI models, revealing that many heavily used but dormant transitive dependencies—often unseen and unaudited—are high risk; in his testing of about 3,000 critical, abandoned projects across multiple ecosystems, roughly 50% had serious vulnerabilities, including logic flaws that can chain across dependency trees. He warns that LLMs accelerate both discovery and exploitation, shrinking traditional 90-day disclosure windows to effectively zero. They urge developers to prune and update dependencies and devices promptly, and to support maintainers respectfully—financially or with broader help—amid vulnerability floods and initiatives like the “Summer of Bliss.”

00:00 UN Open Source Week

00:58 Meet Andrew Nesbitt

01:45 AI Models Meet Dependency Data

04:05 The Hidden Transitive Risk

07:02 Abandoned Packages Crisis

08:34 Why It Matters Now

09:44 Responsible Disclosure Shrinks

11:48 What You Can Do Today

13:10 Support Maintainers Better

15:30 Wrap Up and Call to Action

Special Guest: Andrew Nesbitt.