My AI agent gave a confident security verdict. It had never opened the package

Adding a dependency is the least careful thing most of us do all week. You run npm install some-utils, and you've just agreed to run a stranger's code on your laptop, in your CI, and eventually in pro