AI-suggested packages: avoid typos and fake packages
A hallucinated package name can be a real malware package.
What to do
- Search the official registry (npm, PyPI) and check the publisher, downloads and repository.
- Prefer well-known, maintained packages.
- Pin versions and use a lockfile.
- Run dependency audit tools.
Copy this prompt
For each package you suggested, give the exact registry name, the official repository URL, and say how confident you are it exists. If unsure, suggest a standard-library alternative.Check the bot's work
Verify on the registry before installing.
Questions
Can I trust the bot on dependencies?
Use it to plan and explain, then verify. Verify on the registry before installing.
Which bot works best?
Grok Bot, ChatGPT, Claude and Gemini all handle this prompt. Paste the same prompt into two and compare; disagreements show where to check a source.
Where these facts come from
- OWASP Top 10
- CISA: Secure by Design
- GitHub Docs: Secret scanning
- W3C: WCAG overview
- Open Source Initiative: Licenses
- NIST SP 800-218: Secure Software Development Framework
Tools, features and prices change often. We don't list prices; check each vendor's official pricing page. Never paste secrets into a prompt. Checked Oct 30, 2026.
Coding with bots · Quality, security and careers: all lessons → Next: Licensing and AI code →