Avoid New Dependencies
- Use existing (possibly indirect) dependencies.
- Minimize attack surface.
Evaluate Intended Version
- Verify software version (not personal/attacker-controlled fork).
- Check project name and website link.
- Verify fork relation on GitHub/GitLab.