I need a package listed in the dependency graph, that has a vulnerability, to show up in multiple paths