Not every package is what it seems.
Day 37 was about packages you don't need. Today is about packages that can hurt you, and one risk that's special to AI agents.
Typosquats
Lookalikes
A name one letter off a popular package, waiting for typos.
Made-up names
AI-Specific
Agents sometimes invent package names. Attackers can register those names.
Abandoned
No Longer Fixed
No updates in years. Known holes stay open.
Poisoned updates
Supply Chain
A trusted package ships a bad version.
Defences: run npm audit or pip-audit, turn on GitHub's Dependabot alerts, commit your lock file, and keep “ask before installing” in CLAUDE.md.
Sources: arXiv ↗ · npm Docs ↗
Check the package page before you install.