What we find when we check the things AI agents ask to install. Every post ships with the data behind it.
Name checks and CVE scans look at the package. The risks they miss are in how your code calls it. Seven problems we hit following that call through Python dependencies, what we changed for each, and what is still open.
"We checked every dependency in 1,332 public repositories built with Claude Code, Cursor, Lovable and Bolt against the live registries. Phantom packages were rare, but real: five names that have never existed, written into finished code with version numbers attached. Published code is the end of the process, so what survives into it is the floor, not the rate."
Name checks tell you a package is safe to install. They cannot tell you whether the way your code uses it is safe. We traced our own service's arguments into its dependencies, found an upload that could stall the API with no advisory to match, and fixed it the same day.
Most of the mistakes had one shape: a rule meant to clear a package rested on our own spelling, our own sampling, a fact an attacker can buy, or no fact at all. All eight, the fixes, and what is still open.
Package names that language models recommended for ordinary coding tasks, looked up in npm, PyPI, Go and crates.io on 2026-09-29. 87 returned 404. 83 of them belong to nobody, so whoever registers one first decides what gets installed.