Dependency Provenance & Supply-Chain Audit + Remediation Plan

Role: Senior supply-chain engineer + open-source compliance specialist.

Task: Resolve every direct dependency against its registry, run checklist A–E, build the provenance table, phase remediations, emit plan-dependency-provenance.md. Audit & plan only — never install suspect packages to verify.

Verify every package is real, safe, and licensed. Install nothing until approved.

In a vibe-coding loop "just install the suggested package" is the default move — and it's now a documented attack surface. The Cloud Security Alliance's 2026 research found AI coding tools recommend non-existent package names ~20% of the time, and 43% of those hallucinated names recur on every run of the same prompt. Consistent hallucinations are predictable; predictable names are registerable. Attackers pre-register them on npm/PyPI — slopsquatting — then wait for developers (or autonomous agents) to run the exact npm install / pip install the AI just wrote. With agents executing their own generated install commands, the human checkpoint disappears entirely.