How to filter out vibe-coded dependencies

This is already effectively impossible. It’s only going to get harder. It’s like trying to forbid packages that were developed on Windows. There may be some signs, but they’re not definitive and they’re easy to conceal.