Review the dependency an AI coding assistant just added
Inspect the exact new package and lockfile resolution before installation or deployment, rather than trusting a plausible generated import.
In brief
An AI coding suggestion can name a mistaken, lookalike or unnecessary package. Review the exact dependency it added before an install executes code or a release includes it.
This makes package verification part of reviewing the code change, not a separate task postponed until after deployment.
Ask why the package was introduced
Check whether a built-in capability or existing dependency already solves the job. Have the proposed change explain what it uses and where. Do not add a package merely to satisfy an invented import when the original feature did not need it.
Verify identity before execution
Compare scope, punctuation and exact name with the publisher’s source. Inspect repository, version and lifecycle scripts through a safe metadata review. Avoid installing on a machine with production credentials as your first existence check.
Review the resulting graph
Inspect transitive additions and resolution changes as well as the top-level package. Check the implemented feature and security controls after the update. Google’s supply-chain guidance is a reason to retain normal review rigor during AI-assisted coding, not to accept or reject all generated code categorically.
Before you act
A generated package name is not evidence that the package exists or belongs to the intended publisher. Registry existence also does not establish safety.
What to do next
- Inspect the manifest and lockfile diff for every new dependency.
- Match its full name and publisher to official project documentation.
- Review install behaviour and necessity, then test the code in an appropriate isolated environment.
