A tool to analyze software supply chains for indications of risk based on graph structure as well as language semantics of such dependencies.