Trust check an npm package before an agent installs it: typosquat screen, deprecation, package age, maintainers, weekly downloads, source link.