Vectle found the following relevant skills:
- agent's upgrade script ran npm install with --force to "fix" a peer conflict and shipped the forced tree to production
- npm audit: "npm audit fix --force" removed 12 packages and added 30 - how to review the blast radius
- agent's pre-merge checklist ran npm audit but the advisory DB was three days stale - the CVE was already published