You’re in the flow. You ask Claude Code to add a package for parsing JSON, and it does — poof — a new dependency lands in your project. You don’t check it. Why would you? The AI is smart. It’s never wrong. Right?
Wrong. And that creeping anxiety you feel? It’s justified. Because every time your AI assistant auto-imports a package, it’s rolling the dice on your entire software supply chain. We are outsourcing our software supply chain security to a probabilistic model that doesn’t understand what it’s importing. That’s not a bug. It’s a feature of the current AI workflow.
I know because I build with Claude Code every day. I saw the problem firsthand. I’d ask for a simple utility, and seconds later, a dependency I’d never heard of would be in my package.json. The tool was fast. But fast doesn’t mean safe. It means you can introduce vulnerabilities faster than ever before.
So I built something for myself: a security layer that checks every package before Claude Code adds it. It’s called safer-dependencies. It runs dependency safety checks — things like known vulnerabilities, typosquatting risks, and suspicious package behavior — right inside the development flow. No separate scan. No delayed report. It catches the risk before the code even hits version control.
Here’s the twist: the very thing that makes AI coding assistants so powerful — their ability to autonomously import and integrate — is the same thing that makes them dangerous. Velocity without a security gatekeeper isn’t speed; it’s a race to the bottom.
You might think, “But I review the code after.” Great. But do you vet every transitive dependency? Do you check the maintainer’s history? Do you know if that package was recently updated by a compromised account? The AI doesn’t. And neither do you — not at the speed it operates.
This isn’t about fear-mongering. It’s about facing a reality: we’re all moving fast, and the supply chain is the soft underbelly. The answer isn’t to stop using AI coding tools. It’s to give them a safety belt. Build at the speed of AI, but ship with the security of a human gatekeeper.
I’ve open-sourced safer-dependencies because I know I’m not the only one who feels this tension. Check it out. Integrate it. And next time your AI assistant auto-imports a package, you’ll know it’s been vetted before it becomes your problem.
FAQ
Q: Does this mean I should stop using AI coding assistants?
A: No. The point is to keep using them, but with a security layer that prevents the AI from introducing compromised dependencies. safer-dependencies acts as a gatekeeper, not a blocker.
Q: How does safer-dependencies differ from existing dependency scanners?
A: Most scanners run after the code is committed or during CI. safer-dependencies runs inline, before the dependency is even added to your project. It catches risks at the moment of import, not after the fact.
Q: Is this only for Claude Code, or can I use it with other AI coding tools?
A: Currently designed for Claude Code, but the concept applies to any AI assistant that auto-imports packages. The implementation can be adapted for other tools.