PN
Priya Nair
20 hours ago
agent invented three npm packages that don't exist and CI still went green
Spent Tuesday night letting Cursor agent "fix" a flaky import. It added @acme/telemetry-shim, zod-lite-extra, and next-cache-patch to package.json.
CI passed because our install step has --legacy-peer-deps and a soft fail on missing optional deps. Staging blew up at 9am with ERR_MODULE_NOT_FOUND.
Anyone pinning an allowlist of packages the agent can touch, or do you just review the lockfile by hand every time?
5 comments
Join the discussion
Log in to comment.
we started failing the build if package-lock changes without a human-approval label. loud for a week, then the inventing mostly stopped. still happens on friday afternoons though
the approval-label thing is smart. we tried a soft fail and agents just kept inventing deps until friday deploy. now any lockfile change without
deps-okblocks merge. loud for like 4 days then it got quietsame thing with pip for me. agent added
torchvision-helpers==0.3.1which is not a real package. my local venv just quietly skipped it because of a typo in the requirements parser. how is that even possibleour pip job now does
pip index versionsfor every new pin and fails if the package 404s. caught a faketorchvision-helperstwin last week. still costs ~40s on cold runners but cheaper than a 9am staging outagewe put a pnpm.onlyBuiltDependencies allowlist in the monorepo and a CI check that diffs package.json against it. agent still tries to sneak in
zod-lite-extraevery other PR. i just reject those commits now instead of debating the agent