AI agents pick your deps: 412 packages carry critical flaws
A scan of 95,338 npm, PyPI, crates.io and RubyGems packages found 412 with known critical findings - and agents now install deps no human reviewed.
A crawl of 95,338 packages across npm, PyPI, crates.io, and RubyGems found 412 of them currently carry at least one known critical-severity vulnerability, and another 942 carry a high-severity one.
The numbers come from Package Rating, whose author published the dataset on Dev.to this week. They are the project's own scores, not an independent audit — but they are checkable, and the distribution is the part worth your attention.
Almost nothing scores well
| Band | Packages | Share |
|---|---|---|
| Excellent (90–100) | 34 | 0.04% |
| Good (70–89) | 1,893 | 2.0% |
| Fair (50–69) | 49,707 | 52.1% |
| Poor (25–49) | 43,717 | 45.8% |
| Critical (0–24) | 36 | 0.04% |
Nearly half the scored ecosystem sits in "Poor," and barely 2% clears "Good." The author is careful to note this is not a judgment on individual maintainers — most of these projects are unpaid and unfunded, and doing fine by the standards their authors set.
Popularity buys you almost nothing
The intuition that heavily-downloaded packages get more scrutiny does not hold up in this data. Average score by weekly downloads: packages above 1M average 54.6 (n=11,148), 100k–1M average 54.3 (n=9,983), 10k–100k average 52.6 (n=11,610), and the lowest tier averages 48.4 (n=62,646).
That is a 6-point spread on a 100-point scale between the most- and least-downloaded tiers. The named examples make it concrete — all from packages above 100M weekly downloads:
pyyaml— 279M weekly downloads, 4 critical findings, score 33.5pillow— 125M weekly downloads, 10 critical / 50 high findings, score 38numpy— 260M weekly downloads, 1 critical / 4 high findings, score 38js-yaml— 279M weekly downloads, 1 critical / 3 high findings, score 37.5litellm— 190M weekly downloads, 6 critical / 17 high findings, score 56.3
Why agents change the calculus
The author's argument for why this matters more now than a year ago is the sharpest part of the piece: a growing share of what lands in package.json and requirements.txt was never chosen by a person. An agent hit a missing-import error, picked the first plausible package, and installed it — no README, no GitHub tab, no "last commit was three years ago" gut check.
That gut check was never a strong safety net. But it existed, and for agent-driven installs it usually does not. The practical consequence is that dependency review has to move from human judgment at install time to an automated gate somewhere in CI, because the thing choosing your dependencies cannot read.
What to do this week
Check your own lockfile against the five packages named above first — the author describes all five as foundational, near-universal dependencies across their respective ecosystems, the kind nobody thinks to double-check. Then decide where your gate lives: the project offers scores for any npm, PyPI, crates.io, or RubyGems package on demand at packagerating.com, plus an audit-dependencies GitHub Action that drops the same scoring into CI with an optional threshold gate to fail builds below a bar you set.
Two caveats on the data. The scores combine six weighted signals — commit liveness, community health, dependency risk, known-vulnerability findings, versioning discipline, and general dependency hygiene — so a low score is a composite, not a CVE count. And the figures reflect the catalog as of August 2026; the author is holding back a related "abandoned popular packages" analysis until a recrawl backlog clears.
More from DangMua