fix: Bug with transitive dependency resolution

README.md

@@ -36,6 +36,7 @@ pnpm add <package-name>
       - [Malicious Package Detection](#malicious-package-detection)
       - [Bulk Package Analysis](#bulk-package-analysis)
   - [Contributing](#contributing)
+  - [Limitations](#limitations)
 
 ## Features
 
@@ -134,3 +135,17 @@ pmg --debug npm install <package-name>
 ## Contributing
 
 Refer to [CONTRIBUTING.md](CONTRIBUTING.md)
+
+## Limitations
+
+<details>
+<summary>Approximate dependency version resolution</summary>
+`pmg` resolves the transitive dependencies of a package to be installed. It does it by querying
+package registry APIs such as `npmjs` and `pypi`. However, almost always, dependency versions are
+specified as ranges instead of specific version. Different package managers have different ways of
+resolving these ranges. It also depends on peer or host dependencies already available in the application.
+
+`pmg` is required to block a malicious package *before* it is installed. Hence it applies its own heuristic
+to choose a version from a version range for evaluation. This is fine when all versions of a given package
+is malicious. However, there is a possibility of inconsistency when a specific version of a package is malicious.
+</details>