---
title: "Review every new package · Agent Wranglers"
url: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/review-new-packages
updated: 2026-10-20
licence: "All rights reserved"
---

# Review every new package

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)
- Rule: Check every new dependency before adding it. Attackers publish packages with names close to popular ones, and take over abandoned ones.
- How: Check the exact name, the publisher, the download count and the last release. Write the reason and the official source in the change that adds it. Read any install script. Prefer the standard library or a few lines of your own over a tiny package. Turn off install scripts where you can. Packages an AI suggests may not exist yet, as [check that every package exists](https://agentwranglers.se/playbook/ai-assisted-development/reviewing-agent-output/no-invented-packages) explains.
- Check: List the packages added since the last review. Each one has a named reason and a matching official source.

Example:

```sh
npm config set ignore-scripts true
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/review-new-packages`.

- Previous: [Lock and audit dependencies](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies)
- Next: [Load third-party scripts with integrity checks](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/third-party-scripts)
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup)