Dependency validator reports dependencies in nested packages. However, code in a nested package should be its own package and not contribute to the surrounding package.
In a fresh checkout of https://github.com/dart-lang/native:
$ dart pub global run dependency_validator -C pkgs/code_assets
Validating dependencies for code_assets...
These packages are used outside lib/ but are not dev_dependencies:
* archive
* ffi
* ffigen
* host_name
* http
* mini_audio
* native_toolchain_c
* pointycastle
* sqlite
* sqlite_prebuilt
* stb_image
Packages such as ffigen are only used in pkgs/code_assets/example/host_name/tool/ffigen.dart and pkgs/code_assets/example/host_name/ has it's own pubspec.yaml, it is its own package.