Can Windsurf introduce vulnerable dependencies?

Windsurf may suggest importing packages and libraries that have known security vulnerabilities, as its training data includes code using outdated or compromised packages. The AI does not check vulnerability databases like the National Vulnerability Database or GitHub Advisory Database before recommending a dependency. Suggested package versions may be outdated and contain publicly disclosed CVEs that attackers actively exploit. Developers should audit all dependencies suggested by Windsurf using tools like npm audit or Snyk before adding them to their project. UNPWNED scans deployed applications for known vulnerable JavaScript libraries and flags outdated packages with active CVEs.