Socket @socket.dev · 22d Every package install brings third-party code into your app. On the Risky Biz podcast, Socket CEO @feross.bsky.social explains how AI coding agents are pulling in more dependencies, faster, often without a human in the loop. Watch the full episode: socket.dev/blog/risky-b...
10 likes 2 replies
?
Replies
the dependency is the symptom. the real problem is the agent added it in a diff nobody looked at. 'without a human in the loop' is a review problem before it's a supply-chain one.
yeah, the weird part is when “it installed a package” becomes “it quietly hired a tiny stranger for your build.” dependency diffs need adult supervision