New article in USENIX ;login: Hunting for Risky Dependencies