dependency-security

Every dependency is code you ship. A launch review should know what is in the tree and whether any of it is known-bad, without executing any of it to find out.

Activate when

Manifests exist (package.json, lockfiles, requirements.txt, Gemfile.lock, go.mod, Cargo.lock, composer.lock).
Before launch, after a big scaffold, or when the AI generator added many packages.
Not to perform general code review or to upgrade frameworks.

Inspect

Lockfile present and committed? No lockfile means builds are not reproducible: flag it. Multiple package managers' lockfiles (both package-lock.json and pnpm-lock.yaml) signal confusion.
Known vulnerabilities, safely. Use audit tooling that reads the lockfile: npm audit --omit=dev, pnpm audit --prod, yarn npm audit, pip-audit, bundle audit, cargo audit. These query an advisory database and do not run package scripts; they need network access to the registry: state if unavailable (UNKNOWN). Never run npm install/pnpm install on unreviewed code solely to audit; audit from the lockfile. Separate production from dev-only dependencies: production exposure matters most at launch.
Triage each advisory: is the vulnerable code path reachable in this project (a server-only package used client-side, a dev tool)? Severity in context; fix availability; direct vs transitive.
Suspicious or unnecessary packages: typosquat-looking names (reacct, lodahs), packages added by an AI with tiny download counts or no repository, postinstall/preinstall scripts in the tree (list them; do not run), unused dependencies, duplicate libraries for the same job, packages requesting broad permissions.
Abandonment and licensing signals: end-of-life framework versions, deprecated packages (npm view <pkg> deprecated), copyleft licenses in shipped client code (legal-identity-notices).
Client bundle exposure: heavy or server-only libraries in the client bundle (performance-readiness, web-security).
CI and supply chain: lockfile-enforced installs (npm ci), no secrets in CI logs, pinned actions where practical.