Reviews a dependency change before it merges: the manifest and lockfile diff, install scripts, registry sources, version ranges, and CI install steps. Paste the diff, the lockfile changes, and the package manager and CI commands to find unpinned or swapped sources, dependency confusion, typosquatted names, install-time code execution, and lockfile edits that do not match the manifest. Returns a verdict, a package-by-package change map, evidence-linked findings, the smallest safe fix, and checks that prove the install is pinned and reproducible. Written for backend and platform developers who ship npm, PyPI, Go, or Cargo projects. States the registry, resolver, and advisory data it does not see instead of inventing them. A code review prompt, not a vulnerability scanner or a malware analyzer.