Does anyone check what their AI agent quietly added to package.json?

I was cleaning up a vibe coded project last week and ran npm ls just out of curiosity. 40+ direct dependencies for an app with four screens. Three different date libraries. Two packages that do the same thing as each other. One I’d never heard of, last published 3 years ago, with like 200 weekly downloads.

I never installed any of it myself. The agent just added whatever it needed to get my prompt working, I saw the feature work, and I moved on. I never opened package.json after the first day.

It made me realize every dependency is code I’m shipping without knowing it exists. An abandoned package is a bug waiting to happen, and a typo-squatted one is worse. AI tools also sometimes suggest package names that sound real but don’t exist, and someone can register that exact name later and put something nasty in it. Nobody talks about that part because the app works and nothing looks wrong.

It’s not the code the AI writes that worries me anymore. It’s the code it pulls in.

What I started doing:

• Skim the diff of package.json before every commit, even if I skip the rest

• Google any package name I don’t recognize before keeping it (downloads, last publish date, repo)

• Run npm audit and npm outdated once a week

• Tell the agent in my rules file to use what’s already installed before adding anything new

• Deleted about 15 packages and nothing broke, which is kind of embarrassing

I’m still not sure how to catch the ones that are fine today but get compromised later.

Do you guys review dependencies at all, or just trust the agent? Has an AI ever added a package that didn’t exist or turned out to be sketchy? And does anyone have a lightweight check that doesn’t slow down the vibe?