How to filter out vibe-coded dependencies

I think basically you can’t be satisfied unless you skim through the code of your dependencies – like you probably already would anyway. And have a mental whitelist of things that you accept are a vast trove of somewhat treacherous spaghetti, that you trust anyway, like a GCC or GHC or Cabal.