Vet a package before your AI coding agent uses it — authoritative facts (CVEs, license, …