A developer should be able to see a package vulnerability indicator for any known vulnerability in a transitive package in their dependency graph. 95% of vulnerable dependencies are transitive ones and we should bring awareness to this to help the ecosystem shift left.