The Anthropic SDK Looks Safe. Two of Its Transitive Dependencies Are Not.

The Anthropic SDK Looks Safe. Two of Its Transitive Dependencies Are Not. Sole maintainer. 10M+ weekly downloads. No release in over a year. Run a standard supply chain audit on @anthropic-ai/sdk . You get this: @anthropic-ai/sdk: score=86 14 maintainers 15.1M downloads/week ✅ HEALTHY Looks fine. Anthropic maintains it actively, large team, widely used. Move on. Run it again at depth 2 — checking what the SDK's dependencies depend on: @anthropic-ai/sdk score=86 14 maint 15.1M/wk ✅ HEALTHY └─ jso