Transitive dependencies explained: why a package you never installed can still break your build

You run a scan and get a HIGH severity finding in minimist@1.2.0. You grep your package.json — it isn't there. So why is it in your build? Direct vs transitive A direct dependency is one you declared