Supply chain and setup Required

Review every new package

Check every new dependency before adding it. Attackers publish packages with names close to popular ones, and take over abandoned ones.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Check the exact name, the publisher, the download count and the last release. Read any install script. Prefer the standard library or a few lines of your own over a tiny package. Turn off install scripts where you can.

Example

npm config set ignore-scripts true

How to check

List the packages added since the last review. Each one has a named reason and a matching official source.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/review-new-packages.