Your Package Manifests Are a Supply-Chain Gift to Attackers
Dependency scanners usually run where the code is built. But when the manifests themselves ship to the web root, anyone can download your exact dependency inventory — name, version, architecture — and match it against public vulnerability databases at their leisure. Here's what leaks per ecosystem, and how a free scan turns the same data into your defense.