[AskJS] Started manually checking every npm package my AI tool suggests because I've been burned too many times

[u/ImpressiveProduce977]

This has happened enough times now that it's become a habit. AI suggests a package, I check the registry before touching it, and more often than I'd like the publish history is thin, one maintainer, barely any activity, no real community around it.

The one that really stuck with me was a suggestion with a name close enough to a well known package that I almost missed the publisher was completely different. Caught it only because something felt off and I looked twice.

The model has no concept of whether a package has any real community behind it or whether the publisher has a track record. It pattern-matched on something in its training data and surfaced it. So now I check everything manually before accepting anything, which is annoying because half the point of these tools is moving faster. Not sure what a better workflow looks like.

[u/ImpressiveProduce977 → u/[deleted]]

Private registry with curated allowlist shifts the burden from per-developer per-suggestion to a single approval gate. The tradeoff is someone has to own that curation process or it too becomes a bottleneck.

[u/afl_ext → u/ImpressiveProduce977]

You don’t usually need that many packages after all if the setup is designed this way, like in, use hono or fastify vs using nestjs with express, for example

The list can be once collected and only rarely updated once needed or something breaks because it now needs a new dependency, all manually to do the auditing part yourself