Notifications
Clear all
Topic starter
02/08/2026 11:24 am
TL;DR: AI-assisted coding moves package selection and installation into a workflow where humans may never review the code, while attackers are already poisoning popular dependencies and exploiting slopsquatting, according to Aikido. The governance problem is no longer developer speed but where trust is checked before unreviewed code reaches production.
NHIMG editorial — based on content published by Aikido: Everybody's shipping code they can't read
By the numbers:
- This month, an attacker republished 141 packages in the popular @mastra AI-agent ecosystem in a 45-minute overnight burst, slipping a malicious dependency into every one.
Questions worth separating out
Q: How should security teams govern AI coding assistants that can execute commands?
A: Treat them as delegated non-human identities with bounded execution authority.
Q: Why do AI-generated package choices create more supply chain risk than normal developer workflows?
A: Because the agent can move from intent to execution without the human judgment step that usually filters suspicious packages.
Q: What breaks when automatic install scripts are allowed in AI-assisted builds?
A: Install scripts can execute before trust is established, which lets malicious code stage payloads, touch local storage, or pivot into credentials available in the build environment.
Practitioner guidance
- Control package intake before execution Block known-malicious packages and enforce allowlists or provenance checks before any dependency is installed in agent-driven workflows.
- Disable automatic install scripts by default Require explicit approval for postinstall and other execution hooks, especially in environments where an AI agent selects libraries.
- Separate agent workflows from privileged credentials Run AI coding agents in scoped environments that cannot reach production secrets, signing keys, or long-lived cloud credentials.
What's in the full article
Aikido's full blog post covers the operational detail this post intentionally leaves for the source:
- The package republishing timeline and how the malicious dependency was inserted into the @mastra ecosystem.
- The exact install-time behaviour of the payload, including how it launched and deleted itself to hide evidence.
- The attack path into browser crypto wallets and the persistence methods used across Mac, Windows, and Linux.
- The practical guidance around Aikido Device Protection and the Vibe Coding Checklist for Security.
👉 Read Aikido's analysis of why AI-generated code changes dependency trust →
AI-written code and package trust: are your guardrails keeping up?
Explore further
02/08/2026 12:41 pm
AI coding has turned dependency trust into a non-human decision problem: the central failure is no longer that developers ignore package risk, but that agents can choose, fetch, and execute dependencies without the same review path humans rely on. That shifts governance from code review alone to controls on package provenance, install-time execution, and tool permissions. Practitioner conclusion: security teams need to govern the decision point, not just the resulting code.
A question worth separating out:
Q: How do security teams reduce the impact of slopsquatting and dependency poisoning?
A: Use package allowlisting, provenance validation, and strict egress controls for build environments. Then limit the agent’s ability to resolve or fetch arbitrary dependencies. The point is to ensure that package selection is governed by policy, not by a model’s guess about what package name looks plausible.
👉 Read our full editorial: Everybody's shipping code they can't read, and that changes trust
