The tanstack worm wasn't an attack on agentic coding. It was an attack built for it.

The tanstack worm wasn’t an attack on agentic coding. It was an attack built for it. It hid in .claude/ hooks to survive reboots. It signed its own commits as the Claude Code bot. If you ran any @tanstack/... package during that six-minute compromised window on May 11, this thing was inside your setup, and it looked exactly like normal agent activity the whole time.

The bit nobody’s saying

Most teams treat npm install like a comment change. The agent runs it, the PR rolls in, and nobody looks at the lockfile. That was a reasonable way to operate when a human typed npm install once a week and actually read the diff before committing it.

But adding a dependency was never a normal code change. It’s granting a stranger arbitrary code execution on every developer machine, every CI run, and every production build that touches the package. That should stop an agent cold and wait for a human, every time, no exceptions. Most of us stopped treating it that way not because the risk changed, but because the agent made the action feel like nothing - it’s just another line in a diff, produced at the same speed and with the same confident tone as every other line.

What actually needs to change

In my own setups, agent-added dependencies now get the same treatment I’d give a schema migration: flagged separately from the rest of the diff, classified for risk, and blocked until a human has specifically looked at it. Slower, yes. But it’s also the entire difference between “we caught it” and “we’re rotating every credential at 2am.”

This is exactly what the Cadence PR session review is built around - reading the agent’s session next to the diff, not just the diff alone. A dependency the original task never asked for shows up as a scope-drift finding, attached directly to the package.json line that introduced it. We see this surface on real PRs every week. The diff by itself won’t tell you a dependency was never part of the plan; the session log will.

The real finding

If you didn’t run tanstack that week, don’t be smug about it. The interesting question was never whether you dodged this one specific worm. It’s: what did your agent install this week that nobody reviewed? For most teams, the honest answer is “we don’t know” - and that’s the actual finding here, not the worm itself. The worm just happened to be the thing that made the gap visible.

What gates do you have on agent-added dependencies, and where have they already fallen over?