Plugins to package managers primarily rely on making recommendations to developers by analyzing build manifests in projects. Metadata analysis is typically insufficient for making quick decisions on whether a project is affected by a security or performance bug. Hundreds of hours goes into testing and manual code reviews to determine whether a project is affected.