Prep RoomSign inStart free
Code RoomVetting unfamiliar dependencies
MediumPrep Room Coding #4471

Vetting unfamiliar dependencies

Vibe & agenticCode quality & reviewEntry–Mid~12 min

Your AI assistant, building a JavaScript date feature, generated `import { parseRelative } from 'date-helpers-lite'` and listed it in package.json. You don't recognize the package. What's your process for deciding whether to trust this dependency, and what are the two distinct things that could be wrong with an AI-added package?

Implement
vet_ai_added_dependency(name: str, exists_on_registry: bool, weekly_downloads: int, days_since_first_publish: int, has_source_repo: bool, popular_names: list[str]) → str
Examples
in["date-helpers-lite",false,0,0,false,["date-fns","dayjs","luxon"]]out"hallucinated"
in["date-fns",true,21000000,3400,true,["date-fns","dayjs","luxon"]]out"trusted"
in["date-fnss",true,40,3,false,["date-fns","dayjs","luxon"]]out"typosquat"
What a strong answer looks like

Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.

0:00 of about 12 min

Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.

Which questions mattered is sealed until you submit. Telling you now would just be handing over the edge cases.