Perform read-only software composition and supply-chain security analysis across dependencies, lockfiles, containers, build tooling, and CI/CD. Use for CVE/SCA, transitive dependency, SBOM, dependency confusion, malicious-package indicators, build/dev dependency risk, package provenance, EOL, and remediation prioritization.
