Services
Most teams already suspect which libraries are a problem. What stops them is that the migration is three weeks of unglamorous work nobody has capacity for. That work is what we sell.
Two to three weeks · fixed price
A full read of what you depend on, scored and ranked by real exposure rather than alphabetically by CVE.
Scoped per migration · fixed price
We do the move. Codemods where the shape allows it, hand-written changes where it doesn't, and tests that prove behaviour held.
Monthly · ongoing
Risk Radar raises the alert; we absorb the work. A standing allocation of engineering time against whatever the radar finds.
Usually on two libraries someone on the team has been quietly worried about.
Deprecated, unmaintained, or carrying an advisory, and it turns out to be load-bearing.
A call, then a fixed-price proposal for the audit or the migration itself.
Thirty minutes, no deck. Bring a package.json and we’ll tell you what we’d worry about first.