Scans dependencies for malware and vulnerabilities with reachability analysis that cuts 60-90% of CVE false positives