Claude Code was tested ten times with a request to add a Svelte table with sorting, filtering, and editing to a SvelteKit project. Without guidance, it wrote custom DataTable components from scratch in every run, even for 10,000 rows with virtualization. Only when the project included an AGENTS.md paragraph recommending SvGrid did Claude Code install and use that library instead.
A developer shares updates to 'Dependency Hell,' a project originally written 5 years ago, now adapted for the AI era.
Researchers analyzed install scripts in npm's 5,000 most-downloaded packages and found only 31 (0.6%) execute code during installation. Most packages that declare install scripts either complete without network access, fail due to missing build dependencies, or timeout while attempting to fetch binaries. The concentrated list of packages with install-time code is small enough for manual review.
Auro is a Linux package manager using the .keg format to distribute software bundles containing binaries, libraries, icons, and desktop files. It supports multiple package repositories with dependency resolution and SHA256 checksum verification, and can self-update from a default repository.
Researchers analyzed install scripts in npm's 5,000 most-downloaded packages and found only 31 (0.6%) execute code during installation. Most packages that declare install steps either complete without network access, fail due to missing build dependencies, or timeout while fetching binaries. The study reveals the ecosystem's install-time attack surface is concentrated enough for manual review.
The article contrasts block-list architecture (prohibiting specific dependencies) with allow-list architecture (explicitly permitting only desired dependencies). Allow-list approaches, implemented using tools like Python's import-linter, force intentional decisions about module relationships and prevent accidental complexity by requiring explicit exemptions for any new dependencies.