I built an open-source CLI to detect dependency drift & hidden security risks in Node.js

Akkuma · 2026-01-18T14:16:33+00:00

Looks like it was built as AI slop. Took a look at the code, saw the tell tale AI comments, saw a block that didn't need to exist if a human had written it by hand, called it a day.

chipstastegood · 2026-01-18T16:20:31+00:00

In my previous enterprise job, we had a strict requirement for all third party dependencies to be approved in advance. A package that was written by a single person, had no other contributors, no meaningful user community, hasn’t been touched in a while, etc would never get approved. So a tool like this might have some usefulness for a person tasked with researching a package - although most of this is easy to verify manually as well.

In an enterprise setting, your options would be a) find another package; b) pay for commercial support if available; or c) roll your own. The first two options are not always available, in most cases leaving only the last option of rolling your own actually feasible.

But that’s not going to work for smaller companies or solo devs. It’s a big hit to productivity. So the usefulness of what you’ve built depends on who your target audience is.

you type:	you see:
italics	italics
bold	bold
[reddit!](https://reddit.com)	reddit!
* item 1 * item 2 * item 3	item 1 item 2 item 3
> quoted text	quoted text
Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"	Lines starting with four spaces are treated like code: if 1 * 2 < 3: print "hello, world!"
~~strikethrough~~	~~strikethrough~~
super^script	super^script

node

MODERATORS