The Anthropic SDK Looks Safe. Two of Its Transitive Dependencies Are Not.

A supply-chain audit of the Anthropic SDK found that its top-level dependency tree looks healthy, but deeper layers reveal hidden risk.

Transitive packages like json-schema-to-ts and ts-algebra have single maintainers, huge download counts, and weak maintenance signals.

The finding shows that production systems can still inherit risk from seemingly safe dependencies, especially via runtime and transitive packages.

Deeper dependency-tree reviews are needed to catch compromised or neglected npm packages before they become attack paths.