{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/verify-that-an-ai-suggested-package-actually-exists-and-is-the-one-you-mean",
  "id": "MHC-D-RESEARCH-0660",
  "version": "0.1.0",
  "title": "Verify that an AI-suggested package actually exists and is the one you mean",
  "summary": "A package name is an identifier in a supply chain, not a vocabulary guess.",
  "kind": "protocol",
  "body": "Before adding a new dependency, verify the canonical package, publisher or repository, current maintenance state and whether the named package is actually the intended project. Prefer known official links or ecosystem registries and avoid installing a guessed name merely to see what happens.",
  "limits": [
    "Registry identity does not prove a package is safe; provenance and vulnerability review remain separate controls."
  ],
  "topics": [
    "union-ai-assisted-coding-safeguards"
  ],
  "intents": [],
  "source_ids": [
    "RS-1C68AE8325C384C0"
  ],
  "evidence": [
    {
      "claim": "OWASP recommends auditing AI-suggested dependencies and versions against current vulnerability information rather than assuming a model knows recent CVEs or legitimate package names.",
      "source_id": "RS-1C68AE8325C384C0",
      "role": "supports",
      "note": "Dependency scanners also have coverage and freshness limits; manual package identity and provenance checks can still matter.",
      "locator": "Hallucinated and Outdated Dependencies"
    }
  ],
  "use_when": [
    "The agent proposes a dependency name that looks plausible."
  ],
  "avoid_when": [
    "Registry identity does not prove a package is safe; provenance and vulnerability review remain separate controls."
  ],
  "example": "The agent suggests a helper package; the developer verifies the official project before running any install command.",
  "check": "No new dependency enters the environment based only on an AI-generated name.",
  "steps": [
    "Package exists in the expected registry.",
    "Publisher or canonical project verified.",
    "Name is not a lookalike.",
    "Maintenance state inspected.",
    "Need for the dependency justified."
  ],
  "sources": [
    {
      "id": "RS-1C68AE8325C384C0",
      "title": "Secure Coding with AI Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0660",
      "to": "MHC-D-RESEARCH-0661",
      "type": "use_before",
      "url": "/knowledge/audit-the-version-before-merging-an-ai-added-dependency"
    }
  ],
  "collections": [
    {
      "id": "RC-E25DB1788236EF13",
      "title": "Let coding agents move fast inside a reviewable security boundary",
      "url": "/collections/let-coding-agents-move-fast-inside-a-reviewable-security-boundary"
    }
  ]
}