Protocol
Verify that an AI-suggested package actually exists and is the one you mean
A package name is an identifier in a supply chain, not a vocabulary guess.
When it fits
- The agent proposes a dependency name that looks plausible.
When to avoid it
- Registry identity does not prove a package is safe; provenance and vulnerability review remain separate controls.
Why it matters
Before adding a new dependency, verify the canonical package, publisher or repository, current maintenance state and whether the named package is actually the intended project. Prefer known official links or ecosystem registries and avoid installing a guessed name merely to see what happens.
Steps
- Package exists in the expected registry.
- Publisher or canonical project verified.
- Name is not a lookalike.
- Maintenance state inspected.
- Need for the dependency justified.
An example
The agent suggests a helper package; the developer verifies the official project before running any install command.
Check your result
No new dependency enters the environment based only on an AI-generated name.
Keep this limit in mind
- Registry identity does not prove a package is safe; provenance and vulnerability review remain separate controls.
Connected ideas
Use beforeAudit the version before merging an AI-added dependency
Evidence and sources
OWASP recommends auditing AI-suggested dependencies and versions against current vulnerability information rather than assuming a model knows recent CVEs or legitimate package names.
Dependency scanners also have coverage and freshness limits; manual package identity and provenance checks can still matter.
Secure Coding with AI Cheat Sheet · Hallucinated and Outdated Dependencies