New dependencies added by AI agents: what to check

Where to look

New dependencies appear in your package manifest and lock file, for example package.json and its lock file. A lock file diff can be huge, so check the manifest first.

Questions for each new package

Before you accept one, ask:

• Is it needed, or could a few lines of code do the same?
• Is it maintained, and do you recognise who publishes it?
• Is the name exactly the package you meant? Look-alike names exist.
• Does its licence suit your project?

Let a rule notice it

AgentReceipt raises an info flag whenever a session adds a dependency, and says which one. The decision stays with you, but you never find out about it by accident.