# Finding Relationships Between Ruby's Top 100 Packages and Their Dependencies

DevFeed: [Finding Relationships Between Ruby's Top 100 Packages and Their Dependencies](<https://devfeed.tech/articles/finding-relationships-between-ruby-s-top-100-packages-and-their-dependencies-1545.md>)

Original publisher: [Read original article](<https://shopify.engineering/relationships-between-ruby-top-100-packages-dependencies>)

Author: Kevin Lin

Published: 2022-10-19T19:17:49Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [Ruby](<https://devfeed.tech/topics/ruby.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [data](<https://devfeed.tech/topics/data.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [blog-post](<https://devfeed.tech/tags/blog-post.md>), [data](<https://devfeed.tech/tags/data.md>), [dependencies](<https://devfeed.tech/tags/dependencies.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [packages](<https://devfeed.tech/tags/packages.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>)

## AI overview

This article investigates whether high-download RubyGems packages can depend on lower-download packages that are not covered by the same MFA threshold. It explains how such dependencies could create a software supply-chain security loophole and describes using RubyGems download data to identify potential exceptions.

## Source excerpt

As packages frequently depend on other packages, could some of these big (more than 180M downloads) packages depend on small (less than 180M downloads) packages?