This has happened enough times now that it's become a habit. AI suggests a package, I check the registry before touching it, and more often than I'd like the publish history is thin, one maintainer, barely any activity, no real community around it. The one that really stuck with me was a suggestion with a name close enough to a well known package that I almost missed the publisher was completely different. Caught it only because something felt off and I looked twice. The model has no concept of whether a package has any real community behind it or whether the publisher has a track record. It pattern-matched on something in its training data and surfaced it. So now I check everything manually before accepting anything, which is annoying because half the point of these tools is moving faster. Not sure what a better workflow looks like. submitted by /u/ImpressiveProduce977 [link] [comments]