How do you check that a package your AI suggests is real, is the one you meant, and is safe to install?
- Module
- 04/05
- To read
- ~9 min
A security researcher noticed AI models recommending a Python package that didn’t exist, and published an empty package under that name. What do you think happened next?
In the module you make your guess first, then read what happened and why.
Verify Before You Install
Lock What You Run
Don’t Run Install Scripts You Haven’t Vetted
Keep Scanning After Install
A rule for adding packages
A spec for your own app, as a text file you download. The module also gives you the prompt for Claude Code, Codex or Antigravity, a checklist to check what it built, and recommended skills.
- Staged rollouts
- Least-privilege build jobs