To review a dependency an AI agent adds, check five things: the package exists and is the one intended, its name is exact, it is maintained, its own dependencies are acceptable, and the task truly needs it. Do this on the lockfile diff, not the summary text, because the lockfile shows what installs.
Why agents need this extra look
Coding models can suggest packages that do not exist. A study of 16 code generating models, covering 576,000 code samples, reported average hallucinated package rates of at least 5.2 percent for commercial models and 21.7 percent for open source models, with 205,474 unique hallucinated names. Results depend on the study setup, so do not read them as a rate for your tool. The practical point is that an attacker can register a name a model tends to invent.
The five checks
- Does it exist, and is it the right one? Search the registry yourself. Compare the name letter by letter with the project you meant. Look at the publisher, the repository link, and the creation date. A package created last week with few downloads and a name matching a model suggestion deserves suspicion.
- Is it maintained? Check the last release, open issue count, and whether the repository matches the package. An abandoned package is a future problem even if it is harmless today.
- What does it bring with it? Read the lockfile diff for new transitive packages. One small addition can pull in dozens.
- What does it do on install? Look for install scripts. Where your package manager lets you, disable scripts for review installs.
- Is it needed? Agents often add a library for something the standard library or an existing dependency already does. Ask for the smaller change.
A quick reviewer table
| Signal | Reassuring | Worry |
|---|---|---|
| Age and history | Years of releases | Created recently, few versions |
| Source link | Matches a real repository | Missing or mismatched |
| Name | Exact match to intent | One character off from a known package |
| Install behavior | No scripts | Scripts that fetch or run code |
| Scope of need | Unique function | Duplicates what you have |
Make the machine do the first pass
Do not rely on human attention alone. Add a dependency check to pull request gates so any new package triggers a scan, and a policy for age, license, and known advisories. An allow list for the production tier is stricter and worth it for sensitive repositories. See the AI written pull request review checklist for the wider routine.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how direct and transitive packages appear in one inventory, which is the view you want when an agent adds one line.
Safeguard offers SBOM and dependency scanning, reachability analysis, and pull request gates, and you can run the free scan on a repository.
Quick check
Is a package with many downloads safe?
Not automatically. Download counts can be inflated, and popular packages can be compromised. Use them as one signal among several.
Should agents be allowed to add dependencies at all?
Allow proposals, not unreviewed installs. A human decides, using the checks above.
Sources
Last reviewed: 19 October 2026.
